Summary

The Tracer utility logs a warning when it can't manipulate a segment, this is done to avoid throwing an error and blocking customer code. The log includes the name of the segment that threw an error.

Currently the name of the segment is included using string concatenation with a non-literal variable. We should update this to use constant values for the format string, and leverage the language (i.e. util.format('hello %s', 'Alice'); or console.warn('hello %s', 'Bob');), so that the value is handled properly.

Why is this needed?

According to Semgrep guidance:

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message.

Which area does this relate to?

Tracer

Solution

See recommendation in section above.

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.