Repository: aws/aws-sdk-js
Pull request #3585 (2020-12-18 00:45:48)

throw at invalid profile name in shared ini file
throw at invalid profile name in shared ini file

##### Checklist
<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->

- [x] `npm run test` passes
- [x] changelog is added, `npm run add-change`


aws-sdk-js-automation: 
### AWS CodeBuild CI Report

* CodeBuild project: sdk-v2-github
* Commit ID: 7d72aff2a941173733fcb6741b104cd83d3bc611
* Result: SUCCEEDED
* [Build Logs](https://r6vdd33du7.execute-api.us-west-2.amazonaws.com/Prod/buildlogs?key=ad5ab714-260e-4ba9-8b5b-94b3a4272c82%2Fbuild.log) (available for 30 days)

*Powered by [github-codebuild-logs](https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:277187709615:applications~github-codebuild-logs), available on the [AWS Serverless Application Repository](https://aws.amazon.com/serverless/serverlessrepo/)*


<!--
CREATED BY GITHUB-CODEBUILD-LOGS
-->



Patch:
diff --git a/.changes/next-release/bugfix-Credentials-74d3274e.json b/.changes/next-release/bugfix-Credentials-74d3274e.json
new file mode 100644
index 000000000..1e09531d1
--- /dev/null
+++ b/.changes/next-release/bugfix-Credentials-74d3274e.json
@@ -0,0 +1,5 @@
+{
+  "type": "bugfix",
+  "category": "Credentials",
+  "description": "SDK will throw if shared ini file's profile name can be resolved to __proto__"
+}
\ No newline at end of file
diff --git a/lib/util.js b/lib/util.js
index 28428bf0b..f4f54cf7f 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -219,6 +219,11 @@ var util = {
         var section = line.match(/^\s*\[([^\[\]]+)\]\s*$/);
         if (section) {
           currentSection = section[1];
+          if (currentSection === '__proto__' || currentSection.split(/\s/)[1] === '__proto__') {
+            throw util.error(
+              new Error('Cannot load profile name \'' + currentSection + '\' from shared ini file.')
+            );
+          }
         } else if (currentSection) {
           var item = line.match(/^\s*(.+?)\s*=\s*(.+?)\s*$/);
           if (item) {


Test patch:
diff --git a/test/util.spec.js b/test/util.spec.js
index 248d7e8a3..12caf735a 100644
--- a/test/util.spec.js
+++ b/test/util.spec.js
@@ -310,7 +310,7 @@
   });
 
   describe('AWS.util.ini', function() {
-    return describe('parse', function() {
+    describe('parse', function() {
       it('parses an ini file', function() {
         var ini, map;
         ini = '; comment at the beginning of the line\n[section1] ; comment at end of line\ninvalidline\nkey1=value1 ; another comment\n  key2 = value2;value3\n  key3 = value4 # yet another comment\n[emptysection]\n#key1=value1';
@@ -318,15 +318,38 @@
         expect(map.section1.key1).to.equal('value1');
         expect(map.section1.key2).to.equal('value2;value3');
         expect(map.section1.key3).to.equal('value4');
-        return expect(map.emptysection).to.equal(void 0);
+        expect(map.emptysection).to.equal(void 0);
       });
-      return it('ignores leading and trailing white space', function() {
+
+      it('ignores leading and trailing white space', function() {
         var ini, map;
         ini = '[section1] ; comment at end of line\n\r\tkey1=\t\rvalue1\t\r\n\v\f\tkey2=value2\f\v\n\u00a0key3   =  \u00a0value3\u3000\n[emptysection]';
         map = AWS.util.ini.parse(ini);
         expect(map.section1.key1).to.equal('value1');
         expect(map.section1.key2).to.equal('value2');
-        return expect(map.section1.key3).to.equal('value3');
+        expect(map.section1.key3).to.equal('value3');
+      });
+
+      it('throws if the profile name is __proto__', function(done) {
+        var ini, map;
+        ini = '[__proto__]\nkey1=value1';
+        try {
+          AWS.util.ini.parse(ini);
+        } catch (err) {
+          expect(err.message).to.equal('Cannot load profile name \'__proto__\' from shared ini file.');
+          done();
+        }
+      });
+
+      it('throws if the profile name is "profile __proto__"', function(done) {
+        var ini, map;
+        ini = '[profile __proto__]\nkey2=value2';
+        try {
+          AWS.util.ini.parse(ini);
+        } catch (err) {
+          expect(err.message).to.equal('Cannot load profile name \'profile __proto__\' from shared ini file.');
+          done();
+        }
       });
     });
   });