hashgraph / hashgraph/bucky

`listObjects` does not URL-encode the prefix query parameter

Open
#14 0 comments 0 reactions 0 assignees View on GitHub
Bug
Dominant language
Java
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

### Description

The `listObjects()` method builds the canonical query string by direct string concatenation:

```java
final String canonicalQueryString = "list-type=2&prefix=" + prefix + "&max-keys=" + maxResults;
```

A prefix containing `&`, `=`, `+`, or spaces corrupts the query string structure. This also
causes an incorrect SigV4 canonical query string during signing, causing authentication to
fail even if the HTTP request somehow succeeded.

### Steps to reproduce

The prefix value should be URL-encoded before being placed in the query string, e.g.:

```java
"list-type=2&max-keys=" + maxResults + "&prefix=" + urlEncode(prefix, false)
```

Note: query parameters must also be sorted alphabetically in the canonical form for correct
SigV4 signing.

**Actual behavior**
Special characters in the prefix break the query string and signature.

**Affected file**
`client/src/main/java/com/hedera/bucky/S3Client.java` — `listObjects()` ~line 165

### Additional context

_No response_

### Hedera network

_No response_

### Version

v0.1.0

### Operating system

None

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.