通过节点 ts 将用户输入传递给 dynamo DB 是否安全

Question

I have a function that takes user input and directly passes it to the put function

// user input is message
async addtodb(message: string, partitionkey: string) {
        const params: AWS.DynamoDB.DocumentClient.PutItemInput = {
          TableName: this.tablename,
          Item: {
            [this.key]: partitionkey,
            id: id,
            message,
          },
        };
        return await dynamodb.put(params).promise();
    };

Is it secure to use user input as an Amazon DynamoDB partition key?

is unclear and that is with the partition key aswell. I know the first rule of hacking is never trust user input so does that apply here?

Answer 1

You should always sanitize inputs.

However, you cannot run UDFs or any other type of function on DynamoDB which most attacks try exploit. The only thing you're at risk from is the user storing data that you did not expect.

Partition key is hashed and uses salt, so the distribution of your data won't be impacted either.