fix: resolve issues #3911 and #3939

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!

[Hardikrepo]

Summary

• Security: Logical ID uniqueness check can be bypassed via substring matching #3911 - Security: Logical ID uniqueness check bypass
  Normalized all \do_not_verify\ values in \�erify_logical_id.py\ from plain strings to lists. Python's \in\ operator on a string performs substring matching, allowing a crafted resource type like \AWS::Serverless::Fun\ to bypass the uniqueness check. Using lists ensures exact element matching.

• Globals.Function Architectures should be overridden by resource-level Architectures #3939 - Globals.Function Architectures concatenates instead of overrides
  Added _list_override_properties = frozenset({'Architectures'})\ to \GlobalProperties\ in \globals.py. When \Architectures\ is set at both global and resource level, the resource-level value now replaces the global value entirely. Previously, SAM concatenated both lists (e.g. [x86_64, arm64]), which is invalid since Lambda only supports one architecture.

Files Changed

File	Change
\samtranslator/translator/verify_logical_id.py\	Normalize all \do_not_verify\ values to lists
\samtranslator/plugins/globals/globals.py\	Add _list_override_properties\ and update _merge_dict\
\ ests/translator/test_verify_logical_id.py\	New test file - 9 tests for #3911
\ ests/plugins/globals/test_globals.py\	2 new test cases for #3939

Test Plan

• 55/55 tests pass
• Substring and superstring bypass scenarios explicitly tested
• Architectures override and inheritance both tested
• No existing tests regressed

Fixes#3911
Fixes#3939

[vicheey]

Hi @Hardikrepo

Thanks for the contribution! The #3939 (Architectures concatenation) has been fixed in PR #3945. So that portion of this PR is now redundant.

The #3911 fix (logical ID uniqueness bypass) looks like a separate valid issue though. Would you mind splitting it into its own PR so it can be reviewed independently? That way we don't have to untangle the two changes.

Thanks again for diving into these!