Skip to content

fix(WS2001): handle intrinsic functions in AccessLogSetting.Format#254

Open
abhu85 wants to merge 1 commit intoawslabs:mainfrom
abhu85:fix/ws2001-intrinsic-crash
Open

fix(WS2001): handle intrinsic functions in AccessLogSetting.Format#254
abhu85 wants to merge 1 commit intoawslabs:mainfrom
abhu85:fix/ws2001-intrinsic-crash

Conversation

@abhu85
Copy link

@abhu85 abhu85 commented Feb 24, 2026

Summary

Fixes #253

When AccessLogSetting.Format (REST APIs) or AccessLogSettings.Format (HTTP APIs) is set to an intrinsic function like !Ref or !Sub, the WS2001 rule crashes with:

E0002 Unknown exception while processing rule WS2001: "'dict_node' object has no attribute 'strip'"

Root cause: The _check_log_format method in api_gateway.py calls .strip() on line 78 without checking if the input is a string. When CloudFormation intrinsic functions are used, the value is a dict-like node (e.g., {"Ref": "LogFormat"}), not a string.

Fix: Added a type check at the start of _check_log_format to skip validation when the format is not a string (i.e., when it's an intrinsic function). This prevents the crash and allows templates with parameterized log formats to pass linting.

Changes

  • Added isinstance(log_format, str) check in _check_log_format method
  • Added test templates for both REST APIs (!Ref) and HTTP APIs (!Sub)

Test Plan

  • Reproduced the bug with the exact template from the issue
  • Verified fix prevents the crash
  • All 72 existing tests pass
  • New test templates added:
    • ws2001-rest-ref-format.pass.yaml - Tests !Ref with REST API
    • ws2001-http-sub-format.pass.yaml - Tests !Sub with HTTP API
  • make pr passes (linting, security, complexity checks)

Commands run:

# Reproduce bug (before fix)
cfn-lint template.yaml -a cfn_lint_serverless.rules
# E0002 Unknown exception while processing rule WS2001: "'dict_node' object has no attribute 'strip'"

# After fix - no errors
cfn-lint template.yaml -a cfn_lint_serverless.rules
# (no output = success)

# Run tests
pytest tests/ -v
# 72 passed

# Run PR checks
make pr
# All checks pass

Generated with Claude Code

When AccessLogSetting.Format or AccessLogSettings.Format is set to an
intrinsic function like !Ref or !Sub, the _check_log_format method would
crash with "'dict_node' object has no attribute 'strip'" because it
expected a string but received a dict-like node.

This fix adds a type check at the start of _check_log_format to skip
validation when the format is not a string (i.e., when it's an intrinsic
function). This prevents the crash and allows templates with parameterized
log formats to pass linting.

Fixes awslabs#253

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@abhu85
Copy link
Author

abhu85 commented Mar 3, 2026

Friendly ping for review when you have a chance. This fixes the crash reported in #253 when using intrinsic functions like !Ref or !Sub in AccessLogSetting.Format. All tests pass and make pr checks are green.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

WS2001 crashes with 'dict_node' object has no attribute 'strip' when AccessLogSetting.Format / AccessLogSettings.Format is !Ref

1 participant