mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-19 01:15:04 -05:00
Ashesh Vashi
adbb249604
verify_credentials previously stored pickle.dumps(rds, -1) under session['aws']['aws_rds_obj']; subsequent endpoints unpickled it via pickle.loads. That pickle round-trip was an in-session deserialization vector and forced the session storage to carry binary blobs. The RDS class is a thin wrapper over boto3 clients: all of its mutable state is the credential dict already saved at session['aws']['secret']. Drop the pickled blob and reconstruct RDS per request via a new _get_rds_from_session() helper. boto3 client construction is cheap (microseconds) and clients are cached on the per-request instance. Also fixes a pre-existing latent bug in verify_credentials where status was undefined when the cached creds matched the new ones (only the inside of the cache-miss branch assigned it), now explicitly set to True for the cache-hit path. Five new tests cover: full creds, missing session_token, no aws key, no secret key, and a regression assertion that the cloud.rds module no longer imports the unsafe deserializer.