Description
The listObjects() method builds the canonical query string by direct string concatenation:
final String canonicalQueryString = "list-type=2&prefix=" + prefix + "&max-keys=" + maxResults;
A prefix containing &, =, +, or spaces corrupts the query string structure. This also
causes an incorrect SigV4 canonical query string during signing, causing authentication to
fail even if the HTTP request somehow succeeded.
Steps to reproduce
The prefix value should be URL-encoded before being placed in the query string, e.g.:
"list-type=2&max-keys=" + maxResults + "&prefix=" + urlEncode(prefix, false)
Note: query parameters must also be sorted alphabetically in the canonical form for correct
SigV4 signing.
Actual behavior
Special characters in the prefix break the query string and signature.
Affected file
client/src/main/java/com/hedera/bucky/S3Client.java — listObjects() ~line 165
Additional context
No response
Hedera network
No response
Version
v0.1.0
Operating system
None
Description
The
listObjects()method builds the canonical query string by direct string concatenation:A prefix containing
&,=,+, or spaces corrupts the query string structure. This alsocauses an incorrect SigV4 canonical query string during signing, causing authentication to
fail even if the HTTP request somehow succeeded.
Steps to reproduce
The prefix value should be URL-encoded before being placed in the query string, e.g.:
Note: query parameters must also be sorted alphabetically in the canonical form for correct
SigV4 signing.
Actual behavior
Special characters in the prefix break the query string and signature.
Affected file
client/src/main/java/com/hedera/bucky/S3Client.java—listObjects()~line 165Additional context
No response
Hedera network
No response
Version
v0.1.0
Operating system
None