fix(storage): SignedURL v4 allows headers with colons in value#7543
Merged
BrennaEpp merged 6 commits intogoogleapis:mainfrom Mar 17, 2023
Merged
fix(storage): SignedURL v4 allows headers with colons in value#7543BrennaEpp merged 6 commits intogoogleapis:mainfrom
BrennaEpp merged 6 commits intogoogleapis:mainfrom
Conversation
tritone
approved these changes
Mar 17, 2023
Contributor
tritone
left a comment
There was a problem hiding this comment.
Nice fix. Can you look into adding a test case for this to the cross-lang signed URL conformance tests as well? https://github.com/googleapis/conformance-tests/blob/main/storage/v1/v4_signatures.json
Contributor
Author
Sure thing, I'll open a PR there as discussed offline. |
gcf-merge-on-green bot
pushed a commit
that referenced
this pull request
Mar 21, 2023
🤖 I have created a release *beep* *boop* --- ## [1.30.1](https://togithub.com/googleapis/google-cloud-go/compare/storage/v1.30.0...storage/v1.30.1) (2023-03-21) ### Bug Fixes * **storage:** Retract versions with Copier bug ([#7583](https://togithub.com/googleapis/google-cloud-go/issues/7583)) ([9c10b6f](https://togithub.com/googleapis/google-cloud-go/commit/9c10b6f8a54cb8447260148b5e4a9b5160281020)) * **storage:** SignedURL v4 allows headers with colons in value ([#7543](https://togithub.com/googleapis/google-cloud-go/issues/7543)) ([602014d](https://togithub.com/googleapis/google-cloud-go/commit/602014d2152cffe1860e00b713b1c3c8624e59f9)) * **storage:** SignedURL v4 allows headers with colons in value ([#7603](https://togithub.com/googleapis/google-cloud-go/issues/7603)) ([6b50f9b](https://togithub.com/googleapis/google-cloud-go/commit/6b50f9b368f5b271ade1706c342865cef46712e6)) --- This PR was generated with [Release Please](https://togithub.com/googleapis/release-please). See [documentation](https://togithub.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, this:
would return a URL that would return a 403 (signature mismatch) with the header
x-goog-meta-start-time:2023-02-10T03:;you would have to specify the header as
x-goog-meta-start-time:2023-02-10T03to get a 200 with the provided URL.Based on our public docs, values should be able to use any US-ASCII characters, which includes colons.
This PR fixes the splitting of the headers so that colons (and anything after them) are preserved in the header values.