nit: add extra validation

Author: reedham-aws

samcli/lib/build/app_builder.py

@@ -442,8 +442,11 @@ def _build_lambda_image(self, function_name: str, metadata: Dict, architecture:
         if not isinstance(docker_build_args, dict):
             raise DockerBuildFailed("DockerBuildArgs needs to be a dictionary!")
 
-        if docker_build_extra_params is not None and not isinstance(docker_build_extra_params, list):
-            raise DockerBuildFailed("DockerBuildExtraParams needs to be a list!")
+        if docker_build_extra_params is not None and (
+            not isinstance(docker_build_extra_params, list)
+            or not all(isinstance(p, str) for p in docker_build_extra_params)
+        ):
+            raise DockerBuildFailed("DockerBuildExtraParams must be a list of strings!")
 
         docker_context_dir = pathlib.Path(self._base_dir, docker_context).resolve()
 

tests/unit/lib/build_module/test_app_builder.py

@@ -1792,6 +1792,26 @@ def test_can_build_image_function_with_extra_params(self):
         call_kwargs = mock_build_client.build_image.call_args[1]
         self.assertEqual(call_kwargs["extra_params"], ["--ssh", "default"])
 
+    def test_build_lambda_image_raises_for_non_list_docker_build_extra_params(self):
+        metadata = {
+            "Dockerfile": "Dockerfile",
+            "DockerContext": "context",
+            "DockerTag": "Tag",
+            "DockerBuildExtraParams": "--ssh default",
+        }
+        with self.assertRaises(DockerBuildFailed):
+            self.builder._build_lambda_image("Name", metadata, X86_64)
+
+    def test_build_lambda_image_raises_for_non_string_docker_build_extra_params_element(self):
+        metadata = {
+            "Dockerfile": "Dockerfile",
+            "DockerContext": "context",
+            "DockerTag": "Tag",
+            "DockerBuildExtraParams": ["--build-arg", 42],
+        }
+        with self.assertRaises(DockerBuildFailed):
+            self.builder._build_lambda_image("Name", metadata, X86_64)
+
     def test_build_lambda_image_uses_latest_tag_when_not_specified(self):
         metadata = {
             "Dockerfile": "Dockerfile",