adam/procurement-ingest
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/procurement-ingest.git synced 2026-10-07 16:08:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(api): use .endswith('.amazonaws.com') instead of substring check for execute-api detection

Browse source 
The prior '.execute-api.' in domain substring check is fragile and
triggers CodeQL incomplete-sanitization warnings. All API Gateway default
domains end with .amazonaws.com, so a suffix check is more precise and
also silences the false-positive alert.

Refs: https://github.com/Sea-Haven-Industries/procurement-ingest/security/code-scanning/6
This commit is contained in:
amoussa1229 2026-07-24 22:35:17 +00:00
parent 95ebb30fc4
commit 2598c89abf
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lambdas/api/handler.py
View file

@ -87,8 +87,9 @@ def _base_url(event: dict) -> str | None:
# A custom domain (base-path mapping) serves the stage at the root, so the
# public URL has NO /{stage} segment; only the raw execute-api host carries
# it. Emitting /{stage} for a custom-domain request would advertise a
# broken server URL in the docs.
if ".execute-api." in domain:
# broken server URL in the docs. All API Gateway default domains end with
# .amazonaws.com, so check the suffix rather than a substring.
if domain.endswith(".amazonaws.com"):
return f"https://{domain}/{stage}" if stage else None
return f"https://{domain}"