Invalid Signed URL When Filename Contains Percent Sign
- Dominant language
- JavaScript
- Stars
- 1.7k
- Forks
- 283
- PR merge metrics
- No merged PRs in 30d
Description
Some of our S3 files contain a % sign in the filename - ie. `100% Coverage.pdf`. The url generated by `knoxClient.signedUrl(key, expires)` produces a `SignatureDoesNotMatch` error.
It looks like [signUrl](https://github.com/LearnBoost/knox/blob/master/lib/client.js#L856) uses `url.parse` to get a pathname. It encodes some of the special characters (like a space), but leaves the % unchanged:
```
, pathname = url.parse(filename).pathname
```
I'm sure there's a better way to do this, but here's my fix. If I unescape the pathname (to undo url.parse's encoding) and then use `encodeURI` then the percent sign is properly escaped and the signature is correct.
```
, pathname = encodeURI(unescape(url.parse(filename).pathname))
```
[Here is the patch](https://github.com/bendytree/knox/commit/c7f34b6062881103431427791e2fbc3378ac9174) that I'm using.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in lib/client.js around signUrl at line 856 and inspect how url.parse derives the pathname for keys containing a percent sign. Reproduce the issue with a filename such as `100% Coverage.pdf`, then verify that the generated signed URL no longer produces `SignatureDoesNotMatch`.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100