Maintenance: update warning log in Tracer to better format segment name

[dreamorosi]

Summary

The Tracer utility logs a warning when it can't manipulate a segment, this is done to avoid throwing an error and blocking customer code. The log includes the name of the segment that threw an error.

Currently the name of the segment is included using string concatenation with a non-literal variable. We should update this to use constant values for the format string, and leverage the language (i.e. util.format('hello %s', 'Alice'); or console.warn('hello %s', 'Bob');), so that the value is handled properly.

Why is this needed?

According to Semgrep guidance:

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message.

Which area does this relate to?

Tracer

Solution

See recommendation in section above.

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.

[github-actions]

⚠️ COMMENT VISIBILITY WARNING ⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[github-actions]

This is now released under v1.14.1 version!