`listObjects` does not URL-encode the prefix query parameter
- Dominant language
- Java
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
### Description
The `listObjects()` method builds the canonical query string by direct string concatenation:
```java
final String canonicalQueryString = "list-type=2&prefix=" + prefix + "&max-keys=" + maxResults;
```
A prefix containing `&`, `=`, `+`, or spaces corrupts the query string structure. This also
causes an incorrect SigV4 canonical query string during signing, causing authentication to
fail even if the HTTP request somehow succeeded.
### Steps to reproduce
The prefix value should be URL-encoded before being placed in the query string, e.g.:
```java
"list-type=2&max-keys=" + maxResults + "&prefix=" + urlEncode(prefix, false)
```
Note: query parameters must also be sorted alphabetically in the canonical form for correct
SigV4 signing.
**Actual behavior**
Special characters in the prefix break the query string and signature.
**Affected file**
`client/src/main/java/com/hedera/bucky/S3Client.java` — `listObjects()` ~line 165
### Additional context
_No response_
### Hedera network
_No response_
### Version
v0.1.0
### Operating system
None
Contributor guide
Assessment
This issue has not been assessed yet.