fix(sts): validate RoleSessionName against AWS pattern (reject XML injection) (#2252)

Author: vieiralucas

crates/fakecloud-iam/src/sts_service/assume.rs

@@ -21,6 +21,7 @@ impl StsService {
             )
         })?;
         validate_string_length("roleSessionName", role_session_name, 2, 64)?;
+        validate_session_name(role_session_name)?;
 
         // Validate optional DurationSeconds (used below for expiration)
         if let Some(ds) = req.query_params.get("DurationSeconds") {
@@ -305,6 +306,7 @@ impl StsService {
             )
         })?;
         validate_string_length("roleSessionName", role_session_name, 2, 64)?;
+        validate_session_name(role_session_name)?;
 
         // WebIdentityToken is required
         let web_identity_token = req.query_params.get("WebIdentityToken").ok_or_else(|| {
@@ -657,6 +659,9 @@ impl StsService {
         // the issuer/audience claims used for trust-policy enforcement.
         let role_session_name =
             extract_saml_session_name(saml_assertion).unwrap_or_else(|| "saml-session".to_string());
+        // The SAML-derived session name is attacker-influenced; reject any that
+        // breaks the AWS pattern rather than injecting it raw into the response XML.
+        validate_session_name(&role_session_name)?;
         let saml_claims = extract_saml_claims(saml_assertion);
 
         let partition = partition_for_region(&req.region);

crates/fakecloud-iam/src/sts_service/mod.rs

@@ -54,6 +54,28 @@ fn format_expiration(ts: DateTime<Utc>) -> String {
     ts.format("%Y-%m-%dT%H:%M:%SZ").to_string()
 }
 
+/// Enforce the AWS `RoleSessionName` pattern `[\w+=,.@-]*`. Without this, a
+/// name containing `<`, `>` or `&` is interpolated raw into the AssumedRoleId /
+/// assumed-role ARN in the XML response, producing malformed (and, for the
+/// attacker-controlled SAML session name, injectable) XML that SDK parsers
+/// reject. AWS rejects such input up front with a ValidationError.
+fn validate_session_name(name: &str) -> Result<(), AwsServiceError> {
+    if name
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '+' | '=' | ',' | '.' | '@' | '-'))
+    {
+        return Ok(());
+    }
+    Err(AwsServiceError::aws_error(
+        StatusCode::BAD_REQUEST,
+        "ValidationError",
+        format!(
+            "1 validation error detected: Value '{name}' at 'roleSessionName' failed to satisfy \
+             constraint: Member must satisfy regular expression pattern: [\\w+=,.@-]*"
+        ),
+    ))
+}
+
 /// Test-only wrapper around [`compute_expiration_at`] used by the existing
 /// duration unit tests.
 #[cfg(test)]
@@ -589,6 +611,20 @@ fn extract_saml_session_name(saml_b64: &str) -> Option<String> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn session_name_pattern_accepts_valid_and_rejects_xml_metacharacters() {
+        // AWS-legal characters pass.
+        for ok in ["testuser", "role.session-1", "a+b=c,d.e@f", "user_123"] {
+            assert!(validate_session_name(ok).is_ok(), "should accept {ok}");
+        }
+        // XML metacharacters (and anything else off-pattern) are rejected with
+        // ValidationError rather than injected raw into the response XML.
+        for bad in ["a<b", "a>b", "a&b", "a\"b", "a b", "a/b"] {
+            let err = validate_session_name(bad).unwrap_err();
+            assert_eq!(err.code(), "ValidationError", "should reject {bad:?}");
+        }
+    }
+
     #[test]
     fn test_partition_for_region() {
         assert_eq!(partition_for_region("us-east-1"), "aws");