semgrep updates

Author: GarrettBeatty

.semgrepignore

@@ -1,4 +1,5 @@
 # Ignore test and example files containing dummy credentials
+
 **/test/**/*.json
 **/tests/**/*.json
 **/SampleRequests/**/*.json
@@ -7,6 +8,12 @@
 **/*.min.js
 **/env.configs.yml
 
+# ignore template files
+Blueprints/BlueprintDefinitions/vs2017/*/template/**
+Blueprints/BlueprintDefinitions/vs2019/*/template/**
+Blueprints/BlueprintDefinitions/vs2022/*/template/**
+Libraries/test/*/**
+
 # Ignore third-party libraries
 **/node_modules/**
 **/vendor/**

Tools/LambdaTestTool-v2/src/Amazon.Lambda.TestTool/SampleRequests/SampleRequestManager.cs

@@ -96,7 +96,8 @@ public string GetRequest(string name)
         {
             name = name.Substring(name.IndexOf("@") + 1);
             var savedRequestDirectory = GetSavedRequestDirectory();
-            var path = Path.Combine(savedRequestDirectory, name);
+            var sanitizedName = Path.GetFileName(name);
+            var path = Path.Combine(savedRequestDirectory, sanitizedName);
             return File.ReadAllText(path);
         }
         return GetEmbeddedResource(name);
@@ -110,7 +111,8 @@ public string SaveRequest(string name, string content)
         if (!Directory.Exists(savedRequestDirectory))
             Directory.CreateDirectory(savedRequestDirectory);
 
-        File.WriteAllText(Path.Combine(savedRequestDirectory, filename), content);
+        var sanitizedFilename = Path.GetFileName(filename);
+        File.WriteAllText(Path.Combine(savedRequestDirectory, sanitizedFilename), content);
         return $"{SavedRequestDirectory}@{filename}";
     }
 

Tools/LambdaTestTool/src/Amazon.Lambda.TestTool.BlazorTester/Startup.cs

@@ -109,7 +109,15 @@ public void ConfigureServices(IServiceCollection services)
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
         public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
         {
-            app.UseDeveloperExceptionPage();
+            if (env.IsDevelopment())
+            {
+                app.UseDeveloperExceptionPage();
+            }
+            else
+            {
+                app.UseExceptionHandler("/Error");
+                app.UseHsts();
+            }
 
             app.UseStaticFiles();
 

Tools/LambdaTestTool/src/Amazon.Lambda.TestTool/SampleRequests/SampleRequestManager.cs

@@ -102,7 +102,8 @@ public string GetRequest(string name)
             if(name.StartsWith(SAVED_REQUEST_DIRECTORY + "@"))
             {
                 name = name.Substring(name.IndexOf("@") + 1);
-                var path = Path.Combine(this.GetSavedRequestDirectory(), name);
+                var sanitizedName = Path.GetFileName(name); // Sanitize the filename to prevent path traversal
+                var path = Path.Combine(this.GetSavedRequestDirectory(), sanitizedName);
                 return File.ReadAllText(path);
             }
             return GetEmbeddedResource(name);
@@ -146,4 +147,4 @@ public string GetSavedRequestDirectory()
             return path;
         }
     }
-}
+}