From d7af9e84befcf38c78e0a765ba813a694ff5f26c Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Mon, 21 Apr 2025 22:09:42 -0700
Subject: [PATCH] added more validation to region

---
 .../identity-aws-auth-service.ts               | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
index 68989893f..0849a7523 100644
--- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
+++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
@@ -68,6 +68,18 @@ const awsRegionFromHeader = (authorizationHeader: string): string | null => {
   return null;
 };
 
+
+
+function isValidAwsRegion(region: (string | null)): boolean {
+  const validRegionPattern = new RE2('^[a-z0-9-]+$');
+  if (typeof region !== 'string' || region.length === 0 || region.length > 20) {
+    return false;
+  }
+  
+  return validRegionPattern.test(region);
+}
+
+
 export const identityAwsAuthServiceFactory = ({
   identityAccessTokenDAL,
   identityAwsAuthDAL,
@@ -85,8 +97,12 @@ export const identityAwsAuthServiceFactory = ({
 
     const headers: TAwsGetCallerIdentityHeaders = JSON.parse(Buffer.from(iamRequestHeaders, "base64").toString());
     const body: string = Buffer.from(iamRequestBody, "base64").toString();
-
     const region = headers.Authorization ? awsRegionFromHeader(headers.Authorization) : null;
+
+    if (!isValidAwsRegion(region)) {
+      throw new BadRequestError({message: "Invalid AWS region"});
+    }
+
     const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint;
 
     const {