Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deduplicate slashes for sigv4 signature #364

Merged
merged 2 commits into from Mar 29, 2022
Merged

Deduplicate slashes for sigv4 signature #364

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6008c06
Deduplicate slashes for sigv4 signature
importhuman Mar 18, 2022
f1cb4b8
Use path.Clean to clean sigv4 path.
roidelapluie Mar 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 5 additions & 0 deletions sigv4/sigv4.go
View file
Open in desktop
Expand Up @@ -20,6 +20,7 @@ import (
"io/ioutil"
"net/http"
"net/textproto"
"path"
"sync"
"time"

Expand Down Expand Up @@ -115,6 +116,10 @@ func (rt *sigV4RoundTripper) RoundTrip(req *http.Request) (*http.Response, error
}()
req.Body = ioutil.NopCloser(seeker)

// Clean path like documented in AWS documentation.
// https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
req.URL.Path = path.Clean(req.URL.Path)

// Clone the request and trim out headers that we don't want to sign.
signReq := req.Clone(req.Context())
for _, header := range sigv4HeaderDenylist {
Expand Down
16 changes: 14 additions & 2 deletions sigv4/sigv4_test.go
View file
Open in desktop
Expand Up @@ -64,7 +64,7 @@ func TestSigV4RoundTripper(t *testing.T) {

cli := &http.Client{Transport: rt}

req, err := http.NewRequest(http.MethodPost, "google.com", strings.NewReader("Hello, world!"))
req, err := http.NewRequest(http.MethodPost, "https://example.com", strings.NewReader("Hello, world!"))
require.NoError(t, err)

_, err = cli.Do(req)
Expand All @@ -78,7 +78,7 @@ func TestSigV4RoundTripper(t *testing.T) {
// Perform the same request but with a header that shouldn't included in the
// signature; validate that the Authorization signature matches.
t.Run("Ignored Headers", func(t *testing.T) {
req, err := http.NewRequest(http.MethodPost, "google.com", strings.NewReader("Hello, world!"))
req, err := http.NewRequest(http.MethodPost, "https://example.com", strings.NewReader("Hello, world!"))
require.NoError(t, err)

req.Header.Add("Uber-Trace-Id", "some-trace-id")
Expand All @@ -89,4 +89,16 @@ func TestSigV4RoundTripper(t *testing.T) {

require.Equal(t, origReq.Header.Get("Authorization"), gotReq.Header.Get("Authorization"))
})

t.Run("Escape URL", func(t *testing.T) {
req, err := http.NewRequest(http.MethodPost, "https://example.com/test//test", strings.NewReader("Hello, world!"))
require.NoError(t, err)
require.Equal(t, "/test//test", req.URL.Path)

_, err = cli.Do(req)
require.NoError(t, err)
require.NotNil(t, gotReq)

require.Equal(t, "/test/test", gotReq.URL.Path)
})
}