googleapis / googleapis/google-cloud-rust

Checksum validation skipped when upload status query reports object finalized

Open
#6,686 0 comments 0 reactions 0 assignees View on GitHub
api: storage type: bug
Dominant language
Rust
Stars
955
Forks
144
Avg merge
1d 5h
Merged PRs (30d)
279

Description

Unconfirmed. This is the result of a search with Claude, may be a false positive.

When the response to a final PUT request is lost (e.g. due to connection reset or timeout) and the retry loop performs a status query to check the upload state, the query may discover that the object was already finalized:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/perform_upload/buffered.rs#L99

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/storage/src/storage/perform_upload/unbuffered.rs#L83-L85

In both the buffered and unbuffered uploaders, when the status query indicates the object is finalized, the resulting object metadata is returned directly to the caller, completely bypassing `validate_response_object`. As a result, neither client-side nor server-side checksum verification is performed.

Contributor guide

Open the contributing guide

Research direction

Start in src/storage/src/storage/perform_upload/buffered.rs around line 99 and unbuffered.rs around lines 83-85, then trace the finalized-object status-query path and validate_response_object. Confirm how the returned metadata bypasses validation in both uploaders. Done means finalized uploads perform the applicable client-side and server-side checksum verification before returning metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.