Huang Kuan Hao created HDDS-17172:
-------------------------------------

             Summary: S3 Gateway should reject GetObject/HeadObject requests 
that specify both partNumber and Range
                 Key: HDDS-17172
                 URL: https://issues.apache.org/jira/browse/HDDS-17172
             Project: Apache Ozone
          Issue Type: Bug
          Components: S3
            Reporter: Huang Kuan Hao


AWS S3 rejects a GetObject or HeadObject request that carries both the 
{{partNumber}} query parameter and a {{Range}} header with *400 InvalidRequest* 
("Cannot specify both Range header and partNumber query parameter").

Ozone accepts the combination. {{ObjectEndpoint}} first resolves the requested 
part, then parses the Range against that part's size. The response is *206* 
with {{Content-Range: bytes s-e/<partSize>}}, which matches no AWS behavior.

This affects GetObject today and HeadObject once HDDS-14224 is merged.

Proposed fix:
In {{ObjectEndpoint#get}} and {{ObjectEndpoint#head}}, when {{partNumber != 0}} 
and a {{Range}} header is present, throw {{S3ErrorTable.INVALID_REQUEST}} 
inside the try block, so audit and failure metrics are recorded. Add unit tests 
in {{TestObjectGet}}/{{TestObjectHead}}, plus SDK V1/V2 coverage.

_Found while reviewing HDDS-14224 (PR 
https://github.com/apache/ozone/pull/11612)._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to