fix: throw ValidationException instead of InvalidRequestContent when function name is invalid

bchampp · bchampp · commit 554bcb3dc32a · 2025-10-07T15:22:25.000-04:00
diff --git a/samcli/lib/utils/name_utils.py b/samcli/lib/utils/name_utils.py
@@ -9,11 +9,10 @@
 # Constants for ARN parsing
 PARTIAL_ARN_MIN_PARTS = 3
 FUNCTION_ALIAS_PARTS = 2
+MIN_ARN_PARTS = 5  # Minimum parts for a valid ARN structure
 
-# AWS Lambda function name validation pattern (same as AWS Lambda service)
 LAMBDA_FUNCTION_NAME_PATTERN = (
-    r"^(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?"
-    r"(\d{12}:)?(function:)?([a-zA-Z0-9-_\.]+)(:(\$LATEST(\.PUBLISHED)?|[a-zA-Z0-9-_]+))?$"
+    r"^(arn:[^:]+:lambda:[^:]*:\d{12}:function:|\d{12}:function:)?[a-zA-Z0-9-_\.]+(:[\w$-]+)?$"
 )
 
 
@@ -65,13 +64,6 @@ def normalize_lambda_function_name(function_identifier: str) -> str:
     >>> normalize_lambda_function_name("123456789012:function:my-function")
     "my-function"
     """
-    if not re.match(LAMBDA_FUNCTION_NAME_PATTERN, function_identifier):
-        raise InvalidFunctionNameException(
-            f"1 validation error detected: Value '{function_identifier}' at 'functionName' "
-            f"failed to satisfy constraint: Member must satisfy regular expression pattern: "
-            f"{LAMBDA_FUNCTION_NAME_PATTERN}"
-        )
-
     # Handle full ARN format: arn:aws:lambda:region:account-id:function:function-name[:version]
     if function_identifier.startswith("arn:"):
         try:
@@ -82,9 +74,23 @@ def normalize_lambda_function_name(function_identifier: str) -> str:
                 # Handle versioned functions by splitting on ':'
                 function_name = arn_parts.resource_id.split(":")[0] if arn_parts.resource_id else ""
                 return function_name if function_name else function_identifier
+            elif arn_parts.service != "lambda":
+                # Non-Lambda ARNs should raise an exception
+                raise InvalidFunctionNameException(
+                    f"1 validation error detected: Value '{function_identifier}' at 'functionName' "
+                    f"failed to satisfy constraint: Member must satisfy regular expression pattern: "
+                    f"{LAMBDA_FUNCTION_NAME_PATTERN}"
+                )
         except InvalidArnValue:
-            # If ARN parsing fails, return the original input
-            pass
+            # Very malformed ARNs (like "arn:aws:lambda") should raise an exception
+            if len(function_identifier.split(":")) < MIN_ARN_PARTS:  # ARNs with less than 5 parts are too malformed
+                raise InvalidFunctionNameException(
+                    f"1 validation error detected: Value '{function_identifier}' at 'functionName' "
+                    f"failed to satisfy constraint: Member must satisfy regular expression pattern: "
+                    f"{LAMBDA_FUNCTION_NAME_PATTERN}"
+                )
+            # Other malformed ARNs are returned unchanged
+            return function_identifier
 
     # Handle partial ARN format: account-id:function:function-name[:version]
     # This format has at least 3 parts separated by colons
@@ -95,15 +101,33 @@ def normalize_lambda_function_name(function_identifier: str) -> str:
             # Extract function name (3rd part) and remove any version suffix
             function_name = parts[2]
             return function_name if function_name else function_identifier
+        # Invalid partial ARNs (like empty function name) should raise exception if they look like partial ARNs
+        elif len(parts) >= PARTIAL_ARN_MIN_PARTS and parts[1] == "function":
+            # This looks like a partial ARN but has invalid structure
+            raise InvalidFunctionNameException(
+                f"1 validation error detected: Value '{function_identifier}' at 'functionName' "
+                f"failed to satisfy constraint: Member must satisfy regular expression pattern: "
+                f"{LAMBDA_FUNCTION_NAME_PATTERN}"
+            )
+        # Other invalid partial ARNs are returned unchanged
+        return function_identifier
 
     # Handle function name with alias: my-function:alias
     # This is a simple function name with a single colon for alias/version
     # But exclude partial ARN patterns like "account:function" (missing function name)
     elif ":" in function_identifier:
         parts = function_identifier.split(":")
-        if len(parts) == FUNCTION_ALIAS_PARTS and parts[1] != "function" and parts[0]:
-            # Return just the function name part (before the colon) if it's not empty
+        if len(parts) == FUNCTION_ALIAS_PARTS and parts[1] != "function" and parts[0] and parts[1]:
+            # Return just the function name part (before the colon) if both parts are not empty
             return parts[0]
 
+    # Validate plain function names against the pattern
+    if not re.match(LAMBDA_FUNCTION_NAME_PATTERN, function_identifier):
+        raise InvalidFunctionNameException(
+            f"1 validation error detected: Value '{function_identifier}' at 'functionName' "
+            f"failed to satisfy constraint: Member must satisfy regular expression pattern: "
+            f"{LAMBDA_FUNCTION_NAME_PATTERN}"
+        )
+
     # Handle plain function name: my-function
     return function_identifier
diff --git a/samcli/local/lambda_service/lambda_error_responses.py b/samcli/local/lambda_service/lambda_error_responses.py
@@ -19,6 +19,9 @@ class LambdaErrorResponses:
     # The request body could not be parsed as JSON.
     InvalidRequestContentException = ("InvalidRequestContent", 400)
 
+    # One or more parameters values were invalid.
+    ValidationException = ("ValidationException", 400)
+
     NotImplementedException = ("NotImplemented", 501)
 
     ContainerCreationFailed = ("ContainerCreationFailed", 501)
@@ -85,6 +88,29 @@ def invalid_request_content(message):
             exception_tuple[1],
         )
 
+    @staticmethod
+    def validation_exception(message):
+        """
+        Creates a Lambda Service ValidationException Response
+
+        Parameters
+        ----------
+        message str
+            Message to be added to the body of the response
+
+        Returns
+        -------
+        Flask.Response
+            A response object representing the ValidationException Error
+        """
+        exception_tuple = LambdaErrorResponses.ValidationException
+
+        return BaseLocalService.service_response(
+            LambdaErrorResponses._construct_error_response_body(LambdaErrorResponses.USER_ERROR, message),
+            LambdaErrorResponses._construct_headers(exception_tuple[0]),
+            exception_tuple[1],
+        )
+
     @staticmethod
     def unsupported_media_type(content_type):
         """
diff --git a/samcli/local/lambda_service/local_lambda_invoke_service.py b/samcli/local/lambda_service/local_lambda_invoke_service.py
@@ -172,7 +172,7 @@ def _invoke_request_handler(self, function_name):
             normalized_function_name = normalize_lambda_function_name(function_name)
         except InvalidFunctionNameException as e:
             LOG.error("Invalid function name: %s", str(e))
-            return LambdaErrorResponses.invalid_request_content(str(e))
+            return LambdaErrorResponses.validation_exception(str(e))
 
         stdout_stream_string = io.StringIO()
         stdout_stream_bytes = io.BytesIO()
diff --git a/tests/unit/lib/utils/test_name_utils.py b/tests/unit/lib/utils/test_name_utils.py
@@ -2,161 +2,59 @@
 Tests for samcli.lib.utils.name_utils module
 """
 
-import pytest
+from unittest import TestCase
+
+from parameterized import parameterized
 
 from samcli.lib.utils.name_utils import normalize_lambda_function_name, InvalidFunctionNameException
 
 
-class TestNormalizeLambdaFunctionName:
+class TestNormalizeLambdaFunctionName(TestCase):
     """Test cases for normalize_lambda_function_name function"""
 
-    def test_returns_function_name_unchanged_when_not_arn(self):
-        """Test that regular function names are returned unchanged"""
-        function_name = "my-function"
-        result = normalize_lambda_function_name(function_name)
-        assert result == function_name
-
-    def test_extracts_function_name_from_basic_lambda_arn(self):
-        """Test extracting function name from basic Lambda ARN"""
-        arn = "arn:aws:lambda:us-east-1:123456789012:function:my-function"
-        result = normalize_lambda_function_name(arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_from_versioned_lambda_arn(self):
-        """Test extracting function name from versioned Lambda ARN"""
-        arn = "arn:aws:lambda:us-east-1:123456789012:function:my-function:$LATEST"
-        result = normalize_lambda_function_name(arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_from_numbered_version_lambda_arn(self):
-        """Test extracting function name from numbered version Lambda ARN"""
-        arn = "arn:aws:lambda:us-east-1:123456789012:function:my-function:1"
-        result = normalize_lambda_function_name(arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_from_different_partition(self):
-        """Test extracting function name from Lambda ARN in different partition"""
-        arn = "arn:aws-cn:lambda:cn-north-1:123456789012:function:my-function"
-        result = normalize_lambda_function_name(arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_from_partial_arn(self):
-        """Test extracting function name from partial ARN format"""
-        partial_arn = "123456789012:function:my-function"
-        result = normalize_lambda_function_name(partial_arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_from_partial_arn_with_version(self):
-        """Test extracting function name from partial ARN with version"""
-        partial_arn = "123456789012:function:my-function:$LATEST"
-        result = normalize_lambda_function_name(partial_arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_from_partial_arn_with_numeric_version(self):
-        """Test extracting function name from partial ARN with numeric version"""
-        partial_arn = "123456789012:function:my-function:1"
-        result = normalize_lambda_function_name(partial_arn)
-        assert result == "my-function"
-
-    def test_extracts_function_name_with_alias(self):
-        """Test extracting function name from function name with alias"""
-        function_with_alias = "my-function:v1"
-        result = normalize_lambda_function_name(function_with_alias)
-        assert result == "my-function"
-
-    def test_extracts_function_name_with_latest_alias(self):
-        """Test extracting function name from function name with $LATEST alias"""
-        function_with_alias = "my-function:$LATEST"
-        result = normalize_lambda_function_name(function_with_alias)
-        assert result == "my-function"
-
-    def test_raises_exception_for_non_lambda_arn(self):
-        """Test that non-Lambda ARNs raise InvalidFunctionNameException"""
-        arn = "arn:aws:s3:::my-bucket/my-key"
-        with pytest.raises(InvalidFunctionNameException):
-            normalize_lambda_function_name(arn)
-
-    def test_returns_unchanged_for_invalid_arn(self):
-        """Test that invalid ARNs are returned unchanged"""
-        invalid_arn = "not-an-arn"
-        result = normalize_lambda_function_name(invalid_arn)
-        assert result == invalid_arn
-
-    def test_raises_exception_for_malformed_arn(self):
-        """Test that malformed ARNs raise InvalidFunctionNameException"""
-        malformed_arn = "arn:aws:lambda"
-        with pytest.raises(InvalidFunctionNameException):
-            normalize_lambda_function_name(malformed_arn)
-
-    def test_returns_unchanged_for_invalid_partial_arn(self):
-        """Test that invalid partial ARNs are returned unchanged"""
-        invalid_partial = "123456789012:invalid:my-function"
-        result = normalize_lambda_function_name(invalid_partial)
-        assert result == invalid_partial
-
-    def test_handles_function_name_with_hyphens_and_underscores(self):
-        """Test handling function names with special characters"""
-        function_name = "my-function_name"
-        result = normalize_lambda_function_name(function_name)
-        assert result == function_name
-
-    def test_extracts_function_name_with_special_characters_from_arn(self):
-        """Test extracting function name with special characters from ARN"""
-        arn = "arn:aws:lambda:us-east-1:123456789012:function:my-function_name-test"
-        result = normalize_lambda_function_name(arn)
-        assert result == "my-function_name-test"
-
-    def test_extracts_function_name_with_special_characters_from_partial_arn(self):
-        """Test extracting function name with special characters from partial ARN"""
-        partial_arn = "123456789012:function:my-function_name-test"
-        result = normalize_lambda_function_name(partial_arn)
-        assert result == "my-function_name-test"
-
-    def test_handles_complex_function_names(self):
-        """Test handling complex function names with multiple special characters"""
-        complex_names = [
-            "my-function-with-many-hyphens",
-            "my_function_with_underscores",
-            "MyFunctionWithCamelCase",
-            "function123WithNumbers",
-            "function-with_mixed-chars123",
+    @parameterized.expand(
+        [
+            # Simple function names (pass-through)
+            ("my-function", "my-function"),
+            ("function-with_mixed-chars123", "function-with_mixed-chars123"),
+            # Full ARNs with versions/aliases
+            ("arn:aws:lambda:us-east-1:123456789012:function:my-function", "my-function"),
+            ("arn:aws:lambda:us-east-1:123456789012:function:my-function:$LATEST", "my-function"),
+            ("arn:aws:lambda:us-east-1:123456789012:function:my-function:1", "my-function"),
+            ("arn:aws-cn:lambda:cn-north-1:123456789012:function:my-function", "my-function"),
+            # Partial ARNs
+            ("123456789012:function:my-function", "my-function"),
+            ("123456789012:function:my-function:$LATEST", "my-function"),
+            # Function names with versions/aliases
+            ("my-function:$LATEST", "my-function"),
+            ("my-function:v1", "my-function"),
+            # Invalid partial ARN format (should pass through)
+            ("123456789012:invalid:my-function", "123456789012:invalid:my-function"),
         ]
-
-        for name in complex_names:
-            # Test plain function name
-            result = normalize_lambda_function_name(name)
-            assert result == name
-
-            # Test with alias
-            result = normalize_lambda_function_name(f"{name}:v1")
-            assert result == name
-
-            # Test with full ARN
-            arn = f"arn:aws:lambda:us-east-1:123456789012:function:{name}"
-            result = normalize_lambda_function_name(arn)
-            assert result == name
-
-            # Test with partial ARN
-            partial_arn = f"123456789012:function:{name}"
-            result = normalize_lambda_function_name(partial_arn)
-            assert result == name
-
-    def test_raises_exception_for_invalid_function_names(self):
-        """Test that invalid function names raise InvalidFunctionNameException"""
-        invalid_names = [
-            ":HelloWorld",  # Starts with colon
-            "HelloWorld:",  # Ends with colon (empty alias)
-            "",  # Empty string
-            ":",  # Just colon
-            "function-with-invalid-chars!",  # Invalid characters
-            "123456789012:function:",  # Partial ARN with empty function name
+    )
+    def test_normalize_lambda_function_name(self, input_name, expected_output):
+        """Test normalize_lambda_function_name with various inputs"""
+        result = normalize_lambda_function_name(input_name)
+        self.assertEqual(result, expected_output)
+
+    @parameterized.expand(
+        [
+            ("arn:aws:s3:::my-bucket/my-key",),
+            ("arn:aws:lambda",),
+            (":HelloWorld",),
+            ("HelloWorld:",),
+            ("",),
+            (":",),
+            ("function-with-invalid-chars!",),
+            ("123456789012:function:",),
         ]
+    )
+    def test_raises_exception_for_invalid_function_names(self, invalid_name):
+        """Test that invalid function names raise InvalidFunctionNameException"""
+        with self.assertRaises(InvalidFunctionNameException) as exc_info:
+            normalize_lambda_function_name(invalid_name)
 
-        for invalid_name in invalid_names:
-            with pytest.raises(InvalidFunctionNameException) as exc_info:
-                normalize_lambda_function_name(invalid_name)
-
-            # Check that the error message matches AWS Lambda's format
-            assert "1 validation error detected" in str(exc_info.value)
-            assert f"Value '{invalid_name}' at 'functionName'" in str(exc_info.value)
-            assert "failed to satisfy constraint" in str(exc_info.value)
+        # Check that the error message matches AWS Lambda's format
+        self.assertIn("1 validation error detected", str(exc_info.exception))
+        self.assertIn(f"Value '{invalid_name}' at 'functionName'", str(exc_info.exception))
+        self.assertIn("failed to satisfy constraint", str(exc_info.exception))
diff --git a/tests/unit/local/lambda_service/test_lambda_error_responses.py b/tests/unit/local/lambda_service/test_lambda_error_responses.py
@@ -26,9 +26,18 @@ def test_invalid_request_content(self, service_response_mock):
         response = LambdaErrorResponses.invalid_request_content("InvalidRequestContent")
 
         self.assertEqual(response, "InvalidRequestContent")
+
+    @patch("samcli.local.services.base_local_service.BaseLocalService.service_response")
+    def test_validation_exception(self, service_response_mock):
+        service_response_mock.return_value = "ValidationException"
+
+        response = LambdaErrorResponses.validation_exception("ValidationException")
+
+        self.assertEqual(response, "ValidationException")
+
         service_response_mock.assert_called_once_with(
-            '{"Type": "User", "Message": "InvalidRequestContent"}',
-            {"x-amzn-errortype": "InvalidRequestContent", "Content-Type": "application/json"},
+            '{"Type": "User", "Message": "ValidationException"}',
+            {"x-amzn-errortype": "ValidationException", "Content-Type": "application/json"},
             400,
         )
 
diff --git a/tests/unit/local/lambda_service/test_local_lambda_invoke_service.py b/tests/unit/local/lambda_service/test_local_lambda_invoke_service.py
