smengcl commented on code in PR #11562:
URL: https://github.com/apache/ozone/pull/11562#discussion_r4301717937
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/util/S3Utils.java:
##########
@@ -217,6 +217,13 @@ public static String validateSignatureHeader(HttpHeaders
headers, String resourc
throw ex;
}
+ if (!hasUnsignedPayload(xAmzContentSha256Header) &&
!hasMultiChunksPayload(xAmzContentSha256Header)
+ && !xAmzContentSha256Header.matches("[0-9a-fA-F]{64}")) {
Review Comment:
The new format check deliberately accepts uppercase hex, and the added test
covers it, but the upload paths still compare the header with the lowercase
digest using String.equals (for example S3ObjectWriteGuard.checkContentSha256).
Thus a header containing the uppercase form of the correct SHA-256 passes
this validation and is then rejected as XAmzContentSHA256Mismatch, so the
accepted format is not actually usable.
Normalize the expected value (or compare case-insensitively) before
returning/validating it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
