Automattic / Automattic/knox

Incorrect sign in function signedUrl when filename contains special chars: !'()#*+?

Open
#334 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.7k
Forks
283
PR merge metrics
No merged PRs in 30d

Description

Function `signedUrl` works incorrect with filenames containig special chars.

**Problem:**
Filename for creating sign is converted with code:
`pathname = url.parse(filename).pathname`

But filename for returning url is converted with code:
`return this.url(filename)`

Function `this.url` includes conversion by internal function `encodeSpecialCharacters`, that converts special symbols: `!'()#*+?`. But `url.parse` does not convert these special chars. So results are different. Difference in url & sign cause S3 error _SignatureDoesNotMatch_.

**Example:**
For Filename: `file (1).png`
In sign is: `file%20(1).png`
In url is: `file%20%281%29.png`

**No workaround:**
I can't prepare filename by myself outside the knox. Because if I convert special chars in filename before knox, knox will double convert % char (% → %25) and sign will be incorect again. For this example: `file%2520%25281%2529.png`.

Please, help!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the signedUrl entry point and trace the different handling of filename through url.parse(filename).pathname, this.url(filename), and encodeSpecialCharacters. Reproduce the file (1).png example with the listed special characters, then verify that the value used for signing matches the returned URL without double encoding.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.