From 56ad891c173f5be7f628d4ec58362d290f12131b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 21 Aug 2024 08:55:05 -0400 Subject: [PATCH] fix(ec2): Manage `UnicodeDecodeError` when reading user data (#4788) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rubén De la Torre Vico Co-authored-by: Sergio --- .../ec2_instance_secrets_user_data.py | 24 +++++++++++---- .../ec2_instance_secrets_user_data_test.py | 30 +++++++++++++++++++ 2 files changed, 48 insertions(+), 6 deletions(-) diff --git a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py index 5911c97f8f..d8e7780207 100644 --- a/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py +++ b/prowler/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data.py @@ -8,6 +8,7 @@ from detect_secrets.settings import default_settings from prowler.config.config import encoding_format_utf_8 from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.lib.logger import logger from prowler.providers.aws.services.ec2.ec2_client import ec2_client @@ -24,12 +25,23 @@ class ec2_instance_secrets_user_data(Check): if instance.user_data: temp_user_data_file = tempfile.NamedTemporaryFile(delete=False) user_data = b64decode(instance.user_data) - if user_data[0:2] == b"\x1f\x8b": # GZIP magic number - user_data = zlib.decompress( - user_data, zlib.MAX_WBITS | 32 - ).decode(encoding_format_utf_8) - else: - user_data = user_data.decode(encoding_format_utf_8) + try: + if user_data[0:2] == b"\x1f\x8b": # GZIP magic number + user_data = zlib.decompress( + user_data, zlib.MAX_WBITS | 32 + ).decode(encoding_format_utf_8) + else: + user_data = user_data.decode(encoding_format_utf_8) + except UnicodeDecodeError as error: + logger.warning( + f"{instance.region} -- Unable to decode user data in EC2 instance {instance.id}: {error}" + ) + continue + except Exception as error: + logger.error( + f"{instance.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + continue temp_user_data_file.write( bytes(user_data, encoding="raw_unicode_escape") diff --git a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py index 5361698c36..ed30d270f2 100644 --- a/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py +++ b/tests/providers/aws/services/ec2/ec2_instance_secrets_user_data/ec2_instance_secrets_user_data_test.py @@ -265,3 +265,33 @@ class Test_ec2_instance_secrets_user_data: ) assert result[0].resource_tags is None assert result[0].region == AWS_REGION_US_EAST_1 + + @mock_aws + def test_one_secrets_with_unicode_error(self): + invalid_utf8_bytes = b"\xc0\xaf" + ec2 = resource("ec2", region_name=AWS_REGION_US_EAST_1) + ec2.create_instances( + ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1, UserData=invalid_utf8_bytes + ) + + from prowler.providers.aws.services.ec2.ec2_service import EC2 + + current_audit_info = set_mocked_aws_audit_info( + [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1] + ) + + with mock.patch( + "prowler.providers.aws.lib.audit_info.audit_info.current_audit_info", + new=current_audit_info, + ), mock.patch( + "prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data.ec2_client", + new=EC2(current_audit_info), + ): + from prowler.providers.aws.services.ec2.ec2_instance_secrets_user_data.ec2_instance_secrets_user_data import ( + ec2_instance_secrets_user_data, + ) + + check = ec2_instance_secrets_user_data() + result = check.execute() + + assert len(result) == 0