googleapis / googleapis/google-cloud-rust
Checksum validation skipped when upload status query reports object finalized
- Dominant language
- Rust
- Stars
- 955
- Forks
- 144
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 279
Description
Unconfirmed. This is the result of a search with Claude, may be a false positive.
When the response to a final PUT request is lost (e.g. due to connection reset or timeout) and the retry loop performs a status query to check the upload state, the query may discover that the object was already finalized:
https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/perform_upload/buffered.rs#L99
https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/perform_upload/unbuffered.rs#L83-L85
In both the buffered and unbuffered uploaders, when the status query indicates the object is finalized, the resulting object metadata is returned directly to the caller, completely bypassing `validate_response_object`. As a result, neither client-side nor server-side checksum verification is performed.
Contributor guide
Research direction
Start in src/storage/src/storage/perform_upload/buffered.rs around line 99 and unbuffered.rs around lines 83-85, then trace the finalized-object status-query path and validate_response_object. Confirm how the returned metadata bypasses validation in both uploaders. Done means finalized uploads perform the applicable client-side and server-side checksum verification before returning metadata.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100