[harishxr]

Summary

Adds input validation for the S3 object key used when downloading environment files. When a task uses environmentFiles, the agent joins the S3 bucket and object key from the task definition onto the task's per-task envfile resource directory, and then creates directories, writes, and reads files at that path. The key was used without validation, so a key containing relative path segments could resolve to a location outside the intended resource directory. This change validates the bucket/key before it is used, so it must resolve to a location inside the resource directory.

Implementation details

• Added verifyEnvfileKeyLocal, which uses filepath.IsLocal to confirm the joined bucket/key stays within the resource directory after ., .., and separators are resolved.
• Added getEnvfileDownloadPath, used by both the download and read paths, which validates the bucket/key before joining it onto resourceDir.
• Added the same validation before MkdirAll in createEnvfileDirectory.
• Keys that would resolve outside resourceDir are rejected and fail the envfile resource transition; legitimate nested keys are unaffected.

Testing

• Added unit tests covering the new validation:
  • TestVerifyEnvfileKeyLocal — exercises the helper directly: simple, nested, and parent-reference-resolving-back-inside keys are allowed; keys that resolve outside the resource directory (including backslash-padded keys) are rejected.
  • TestCreateRejectsNonLocalKey — a single envfile whose key resolves outside resourceDir fails the resource transition before any temp file is created or any S3 download is attempted.
  • TestCreateRejectsNonLocalEnvfileInMultiFileSet — with one normal and one non-local key downloading concurrently, the non-local key is rejected and never renamed into place, while every rename that occurs stays within resourceDir.
  • TestReadEnvVarsRejectsNonLocalKey — the read path is validated as well.
  • Existing tests (TestCreateWithEnvVarFile, TestReadEnvVarsFromEnvfiles, etc.) continue to pass, confirming legitimate nested keys are unaffected.
• go test -tags unit ./agent/taskresource/envFiles/ passes.
• Built the agent image (make release-agent), loaded it on a fresh Amazon Linux 2023 instance, and ran ECS tasks (EC2 launch type) with environment files staged in S3:
  • A task with a normal envfile key starts successfully and the environment variable from the file is present in the container.
  • A task with a key that resolves outside the resource directory fails to start with the validation error, and no file is written outside the per-task directory.
  • A task definition listing one normal and one non-local key behaves the same — the non-local key is rejected and nothing is written outside the per-task directory.

New tests cover the changes: yes

Description for the changelog

Bugfix - Validate environment file S3 keys so they stay within the task resource directory

Additional Information

Does this PR include breaking model changes? If so, Have you added transformation functions? no

Does this PR include the addition of new environment variables in the README? no