hashgraph / hashgraph/bucky

Object keys are not URL-encoded in multipart upload methods

Open
#13 0 comments 0 reactions 0 assignees View on GitHub
Bug
Dominant language
Java
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

### Description

`uploadTextFile()` and `downloadTextFile()` correctly call `urlEncode(key, true)` when
building their request URLs. However, `createMultipartUpload()`, `multipartUploadPart()`,
`completeMultipartUpload()`, and `abortMultipartUpload()` concatenate the object key directly
into the URL without encoding. Object keys containing spaces, `+`, `#`, or other reserved
characters will produce malformed URLs, incorrect SigV4 signatures, and failed requests.

### Steps to reproduce

1. Call `uploadFile()` with an `objectKey` containing a space (e.g., `"my folder/file.txt"`).
2. The internally called `createMultipartUpload()` constructs:
`endpoint + bucketName + "/" + key + "?uploads="`
The space is not encoded, producing a broken URL.

**Expected behavior**
All methods that embed an object key in a URL should call `urlEncode(key, true)`.

**Actual behavior**
Keys with special characters produce malformed URLs and authentication failures.

**Affected file**
`client/src/main/java/com/hedera/bucky/S3Client.java` — lines ~436, ~481, ~530, ~400

### Additional context

_No response_

### Hedera network

_No response_

### Version

v0.1.0

### Operating system

None

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.