ExAwsSnsVerifier.Url (ex_aws_sns_verifier v0.1.0)

Copy Markdown View Source

URL host validation helpers for AWS SNS signing cert and subscribe URLs.

Hardens SigningCertURL and SubscribeURL parsing by:

  • Requiring HTTPS scheme
  • Validating host matches sns.<region>.amazonaws.com(.cn)? pattern
  • Rejecting URLs with userinfo (credentials in URL)
  • Requiring .pem extension for cert URLs

Summary

Functions

hostname_regex(allowed_regions)

Build a hostname regex pattern from a list of allowed AWS regions.

validate_signing_cert_url(url, allowed_regions)

Validate and parse a SigningCertURL.

validate_subscribe_url(url, allowed_regions)

Validate and parse a SubscribeURL.

Functions

hostname_regex(allowed_regions)

@spec hostname_regex([String.t()]) :: Regex.t()

Build a hostname regex pattern from a list of allowed AWS regions.

Matches sns.<region>.amazonaws.com and sns.<region>.amazonaws.com.cn.

validate_signing_cert_url(url, allowed_regions)

@spec validate_signing_cert_url(String.t(), [String.t()]) ::
  {:ok, URI.t()} | {:error, atom()}

Validate and parse a SigningCertURL.

Returns {:ok, uri} on success or {:error, :invalid_cert_url} on failure.

validate_subscribe_url(url, allowed_regions)

@spec validate_subscribe_url(String.t(), [String.t()]) ::
  {:ok, URI.t()} | {:error, atom()}

Validate and parse a SubscribeURL.

Returns {:ok, uri} on success or {:error, :invalid_subscribe_url} on failure.