From 6985e7c7095cf421f4d96424342699ef4e511c31 Mon Sep 17 00:00:00 2001 From: Sri Aakash Mandavilli Date: Wed, 15 Jul 2026 22:12:43 +0000 Subject: [PATCH] fix(sagemaker): Validate clusterId format in open-notebook extension Add input validation for the clusterId URL parameter in the sagemaker-open-notebook extension. Previously only region was validated (isValidRegion); this adds an equivalent isValidClusterId check so clusterId is restricted to alphanumeric characters, hyphens, and underscores before it is used to generate notebook cell content. Malformed values are rejected with a user-facing error. --- .../sagemaker-open-notebook-extension.diff | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/patches/sagemaker/sagemaker-open-notebook-extension.diff b/patches/sagemaker/sagemaker-open-notebook-extension.diff index 1eb83a82..533a08e9 100644 --- a/patches/sagemaker/sagemaker-open-notebook-extension.diff +++ b/patches/sagemaker/sagemaker-open-notebook-extension.diff @@ -128,7 +128,7 @@ Index: code-editor-src/extensions/sagemaker-open-notebook-extension/src/extensio =================================================================== --- /dev/null +++ code-editor-src/extensions/sagemaker-open-notebook-extension/src/extension.ts -@@ -0,0 +1,100 @@ +@@ -0,0 +1,111 @@ + +import * as vscode from 'vscode'; +import * as https from 'https'; @@ -154,11 +154,22 @@ Index: code-editor-src/extensions/sagemaker-open-notebook-extension/src/extensio + return regionRegex.test(region); +} + ++function isValidClusterId(clusterId: string): boolean { ++ // Cluster IDs/names are alphanumeric with hyphens and underscores only ++ const clusterIdRegex = /^[a-zA-Z0-9_-]+$/; ++ return clusterIdRegex.test(clusterId); ++} ++ +async function loadAndDisplayNotebook(fileKey: string, clusterId: string, region: string) { + if (!isValidRegion(region)) { + vscode.window.showErrorMessage('Invalid region format. Region should only contain characters, numbers, and hyphens.'); + return; + } ++ ++ if (clusterId && !isValidClusterId(clusterId)) { ++ vscode.window.showErrorMessage('Invalid cluster ID format. Cluster ID should only contain letters, numbers, hyphens, and underscores.'); ++ return; ++ } + + const bucketName = `jumpstart-cache-prod-${region}`; + const url = `https://${bucketName}.s3.${region}.amazonaws.com/${fileKey}`;