能否在AWS AppSync解析器映射模板中清洗用户输入？或需用Lambda执行清洗？

Great question—protecting against malicious scripts in user comments is critical for security, and AWS AppSync gives you a couple of ways to handle this. Let’s break down both options:

Using AppSync Resolver Mapping Templates (VTL) for Basic Sanitization #

You absolutely can perform basic input cleaning directly in AppSync’s Velocity Template Language (VTL) mapping templates before saving to your database. AppSync provides built-in utility functions that help escape or strip potentially dangerous characters.

For example, if you’re saving comments to DynamoDB, you could modify your request mapping template to sanitize the input using $util.escapeHtml() or $util.escapeJavaScript():

{
  "version": "2017-02-28",
  "operation": "PutItem",
  "key": {
    "commentId": { "S": "$util.autoId()" }
  },
  "attributeValues": {
    "content": { "S": "$util.escapeHtml($ctx.args.commentContent)" },
    "authorId": { "S": "$ctx.identity.sub" }
  }
}

This will escape HTML entities (like < to <), preventing scripts from executing when the comment is rendered later. However, keep in mind the limitations:

• VTL is a templating language, not a full programming language. Complex sanitization (like detecting obfuscated scripts or custom content rules) is difficult to implement here.
• You don’t have access to dedicated sanitization libraries that are updated to counter new XSS techniques.

Using Lambda for Robust, Production-Grade Sanitization (Recommended) #

For comprehensive protection against XSS and other injection attacks, using a Lambda function is the better approach. Lambda lets you leverage battle-tested sanitization libraries (like DOMPurify for Node.js or bleach for Python) that handle edge cases VTL can’t.

Here’s how to set it up:

1. Create a Lambda function: Write a function that takes the raw user input, runs it through a sanitizer, and returns the cleaned content. For example, a Node.js function using DOMPurify:

   const DOMPurify = require('dompurify');
   const { JSDOM } = require('jsdom');
   
   const window = new JSDOM('').window;
   const purify = DOMPurify(window);
   
   exports.handler = async (event) => {
     const rawComment = event.arguments.commentContent;
     const cleanedComment = purify.sanitize(rawComment);
     return { cleanedComment };
   };
   

2. Set up an AppSync pipeline resolver: Create a pipeline where the first step invokes your sanitization Lambda, and the second step saves the cleaned content to your database. This ensures only sanitized data reaches your storage layer.

Benefits of using Lambda:

• Access to industry-standard sanitization tools that are regularly updated to address new threats.
• Ability to add custom logic (like checking for banned words, rate limiting, or integrating with third-party content moderation services).
• Easier to maintain and update compared to complex VTL templates.

Which Approach Should You Pick? #

• Go with VTL if you only need simple escaping and want to minimize latency/complexity (no extra Lambda invocations). Just remember it’s not a silver bullet for all XSS scenarios.
• Use Lambda if you’re dealing with user-generated content that will be displayed to other users. It’s the most reliable way to ensure your app is protected against malicious scripts.

Pro tip: Even with backend sanitization, adding frontend escaping (like rendering comments as plain text or using safe rendering libraries) adds an extra layer of defense (defense in depth).

内容的提问来源于stack exchange，提问作者rksh1997