Automattic / Automattic/knox

Invalid Signed URL When Filename Contains Percent Sign

Open
#255 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.7k
Forks
283
PR merge metrics
No merged PRs in 30d

Description

Some of our S3 files contain a % sign in the filename - ie. `100% Coverage.pdf`. The url generated by `knoxClient.signedUrl(key, expires)` produces a `SignatureDoesNotMatch` error.

It looks like [signUrl](https://github.com/LearnBoost/knox/blob/master/lib/client.js#L856) uses `url.parse` to get a pathname. It encodes some of the special characters (like a space), but leaves the % unchanged:

```
, pathname = url.parse(filename).pathname
```

I'm sure there's a better way to do this, but here's my fix. If I unescape the pathname (to undo url.parse's encoding) and then use `encodeURI` then the percent sign is properly escaped and the signature is correct.

```
, pathname = encodeURI(unescape(url.parse(filename).pathname))
```

[Here is the patch](https://github.com/bendytree/knox/commit/c7f34b6062881103431427791e2fbc3378ac9174) that I'm using.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in lib/client.js around signUrl at line 856 and inspect how url.parse derives the pathname for keys containing a percent sign. Reproduce the issue with a filename such as `100% Coverage.pdf`, then verify that the generated signed URL no longer produces `SignatureDoesNotMatch`.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.