Skip to content

fix(parameters): stop SecretsProvider.get_multiple mutating the caller's Filters list - #8684

Closed
ShussMiao wants to merge 1 commit into
aws-powertools:developfrom
ShussMiao:fix/secrets-get-multiple-caller-filters
Closed

ShussMiao wants to merge 1 commit into
aws-powertools:developfrom
ShussMiao:fix/secrets-get-multiple-caller-filters

Conversation

@ShussMiao

Copy link
Copy Markdown
Contributor

Issue number: closes #8596

Summary

Changes

SecretsProvider._get_multiple took the Filters value straight out of sdk_options and appended the generated name filter onto that same list object, so a caller-owned list was mutated in place. It now copies the list before appending.

Adds a regression test that reuses one caller-owned Filters list across two get_multiple calls and asserts, via Stubber expected parameters, that each request carries exactly the caller's filter plus the current name filter — and that the caller's list is unchanged afterwards.

User experience

Callers that pass a shared or module-level Filters list (as the docs example shows) no longer accumulate a stale name filter on every call, so a second request can no longer return secrets that were not asked for.

Testing

tests/functional/parameters/ — 184 passed. The new test fails on the previous code with the second request carrying three filters, and passes after the copy. ruff check and ruff format --check are clean on both files.


By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…r's Filters list

`_get_multiple` read `Filters` straight out of `sdk_options` and appended the
`name` filter onto that same list object. When a caller passes a shared or
module-level `Filters` value, every call leaves one extra `name` filter behind,
so the next request goes out with a stale filter and can return secrets that
were never asked for.

Copy the list before appending so the caller's value is left untouched.

Signed-off-by: ShussMiao <168898188+ShussMiao@users.noreply.github.com>
@ShussMiao
ShussMiao requested a review from a team as a code owner October 28, 2026 08:44
@ShussMiao
ShussMiao requested a review from hjgraca October 28, 2026 08:44
@powertools-for-aws-oss-automation powertools-for-aws-oss-automation Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 28, 2026
@boring-cyborg boring-cyborg Bot added the tests label Oct 28, 2026
@boring-cyborg

boring-cyborg Bot commented Oct 28, 2026

Copy link
Copy Markdown

Thanks a lot for your first contribution! Please check out our contributing guidelines and don't hesitate to ask whatever you need.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

@sonarqubecloud

Copy link
Copy Markdown

@leandrodamascena

Copy link
Copy Markdown
Contributor

Thanks @ShussMiao, the fix is right, but #8604 by @wanjinhao1 had already landed this same change for #8596 a few days before you opened this, so I'm closing it as a duplicate. Your other PR, #8691, is merged and you're credited in 3.39.0. There are more good first issue bugs open if you want another one, and please comment on the issue first so we can assign it to you and avoid two people working on the same thing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/M Denotes a PR that changes 30-99 lines, ignoring generated files. tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: SecretsProvider.get_multiple appends to the caller's Filters list on every call

2 participants