github-actions[bot] commented on code in PR #68476:
URL: https://github.com/apache/doris/pull/68476#discussion_r4090713560
##########
be/src/util/s3_util.cpp:
##########
@@ -291,7 +291,7 @@ Result<std::shared_ptr<io::ObjStorageClient>>
S3ClientFactory::_create_azure_cli
VLOG_DEBUG << "uri:" << uri << ", normalized_uri:" << normalized_uri;
std::string tls_debug_context =
build_azure_tls_debug_context(ca_cert_file_path);
- auto built = AzureAuthFactory::create(uri,
+ auto built = AzureAuthFactory::create(normalized_uri,
Review Comment:
Passing `normalized_uri` here fixes ordinary SDK operations, but the
returned `AzureObjStorageClient` still stores `.endpoint = s3_conf.endpoint`
below. With `https://acct.blob.core.windows.net/`, `generate_presigned_url()`
therefore formats `https://acct.blob.core.windows.net//container/key?...`,
while `BlobSasBuilder` signed `container/key`. [Azure derives the canonicalized
resource from the request URI
path](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key#constructing-the-canonicalized-resource-string),
so this can make the cloud load-error-log URL fail authorization even though
upload/read now work. Please carry the canonical endpoint/container join into
the SAS path (or derive the blob URL from the SDK client) and add a
trailing-slash test for both URLs. Avoid normalizing the whole blob/SAS URL
because `//` can be valid inside a blob key.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
