[vinsymoyya]

Which issue(s) does this change fix?

Fixes #9396.

Why is this change necessary?

Fn::Sub treats resolved values as regex replacement strings. Backslashes can raise re.error or silently change the value. During permissive local template resolution, an exception leaves the affected environment variable as an unresolved expression.

How does it address the issue?

Use literal string replacement after resolving each substitution. Add six regressions covering parameter defaults containing unknown escapes, backreferences, newline escapes and doubled backslashes; a variable-map value; and a function environment variable resolved through the real SamBaseProvider.

What side effects does this change have?

Backslashes in resolved substitution values are preserved literally. No CLI options, dependencies or deployment APIs change.

Validation

• All six new regressions fail against the original implementation.
• Python 3.12: 322 affected tests passed; mypy passed across 1,377 source files. Changed-file formatting and repository lint passed.
• Full make pr on Linux/Python 3.11: 9,758 tests passed, 28 skipped, 40 subtests passed, 94.09% coverage. Schema generation, Black, Ruff and mypy passed.

Mandatory Checklist

• Reviewed the generative AI contribution guidelines
• Added input/output type hints to the changed production method
• Design document: not needed for this focused bug fix
• Added unit regressions
• Integration coverage: regression uses the real local template provider, translator plugins and intrinsic resolver without AWS services or Docker
• Functional tests: no separate CLI/interface change
• make pr passes
• Reproducible requirements: no dependency changes
• Documentation: substitution semantics corrected; no CLI help changes

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[valerena]

It's always scary to change code that was last updated 7 years ago, but I don't see a reason to keep using a regex sub instead of a regular string replace, so it looks good to me.