Gargi-jais11 commented on code in PR #11222:
URL: https://github.com/apache/ozone/pull/11222#discussion_r4012844502
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/SignedChunksInputStream.java:
##########
@@ -113,8 +123,23 @@ public class SignedChunksInputStream extends InputStream {
private boolean isFinalChunkEncountered = false;
public SignedChunksInputStream(InputStream inputStream, String keyPath) {
+ this(inputStream, keyPath, null);
+ }
+
+ /**
+ * Creates a signed chunk stream.
+ *
+ * @param inputStream the encoded request body
+ * @param keyPath resource used in S3 errors
+ * @param trailerHeader the value of x-amz-trailer, or null when no trailer
is expected
+ */
+ public SignedChunksInputStream(InputStream inputStream, String keyPath,
String trailerHeader) {
originalStream = inputStream;
this.keyPath = keyPath;
+ this.trailerHeader = trailerHeader == null ? null :
trailerHeader.trim().toLowerCase(Locale.ROOT);
+ if (this.trailerHeader != null &&
!CHECKSUM_TRAILER_PATTERN.matcher(this.trailerHeader).matches()) {
+ throw invalidBody("Invalid x-amz-trailer header");
Review Comment:
AWS allows x-amz-trailer to list multiple trailing header names
(comma-separated). We only accept a single x-amz-checksum-* here via
CHECKSUM_TRAILER_PATTERN. Please either document “single trailer only” or
split x-amz-trailer, read each trailer line in validateTrailer(), and hash
canonical trailing headers
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/SignedChunksInputStream.java:
##########
@@ -200,11 +225,14 @@ private boolean ensureChunkPayload() throws IOException {
return true;
}
if (remainingData == 0) {
- // final zero-byte chunk: verify it (empty payload) and stop reading
- if (validator != null) {
+ // The final zero-byte chunk has no payload terminator when trailing
headers follow it.
+ if (validator != null && trailerHeader == null) {
readChunkTerminator();
}
validateChunk();
+ if (trailerHeader != null) {
+ validateTrailer();
+ }
Review Comment:
+1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
