[alextwoods]

Improve SnsMessageManager parsing, certificate handling and validation

Motivation and Context

Follow-up hardening of the sns-message-manager module. Message parsing, certificate retrieval and field validation in SnsMessageManager were reworked to be more robust and to do less work for messages that cannot validate.

Modifications

• Certificate retrieval. Signing certificates are cached by certificate content rather than by SigningCertURL. Before a certificate is fetched, the message signature is checked against the certificates already cached; a fetch only happens when none of them verifies. Concurrent downloads are bounded, concurrent requests for the same URL are collapsed into one, and response bodies are closed on error responses.
• URL validation. The HTTPS / regional-host rules for SigningCertURL are shared through a new internal SnsEndpointUrlValidator and also applied to SubscribeURL and UnsubscribeURL. SigningCertURL path and query remain unconstrained.
• Field validation. Signature, SignatureVersion, Timestamp and SigningCertURL must be present and well formed before the certificate is retrieved. Signed fields other than Message must be present and single-line. Unsupported signature versions and missing fields now fail with SdkClientException instead of IllegalArgumentException / NullPointerException.
• Parsing. SnsMessageUnmarshaller reads the message with the streaming JSON parser and copies only the fields the message manager uses; other fields are skipped. Malformed JSON and non-object bodies fail with SdkClientException.

Public API is unchanged. Messages delivered by Amazon SNS are unaffected; Message may still contain line breaks.

Testing

New and existing unit tests.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

License

• I confirm that this pull request can be released under the Apache 2 license