rgw: escape aws4 query string

Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>

diff --git a/src/rgw/rgw_auth_s3.cc b/src/rgw/rgw_auth_s3.cc
index 7befb85304d922f718a141f76b1ff4b346e6038f..82ea8763f2d95af47bb55be3304b7e75d5c842fc 100644 (file)
--- a/src/rgw/rgw_auth_s3.cc
+++ b/src/rgw/rgw_auth_s3.cc
@@ -240,8 +240,9 @@ void rgw_assemble_s3_v4_canonical_request(const char *method, const char *canoni
   }
   dest.append("\n");
 
-  if (canonical_qs)
+  if (canonical_qs) {
     dest.append(canonical_qs);
+  }
   dest.append("\n");
 
   if (canonical_hdrs)

diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc
index e5908935e9422d58a242ad710981b672e1fa877f..d09dbdde8c19cd7d5c4794d5ed80bd2014c8bd6c 100644 (file)
--- a/src/rgw/rgw_common.cc
+++ b/src/rgw/rgw_common.cc
@@ -943,7 +943,7 @@ bool url_decode(const string& src_str, string& dest_str, bool in_query)
   return true;
 }
 
-static void escape_char(char c, string& dst)
+void rgw_uri_escape_char(char c, string& dst)
 {
   char buf[16];
   snprintf(buf, sizeof(buf), "%%%.2X", (int)(unsigned char)c);
@@ -987,7 +987,7 @@ void url_encode(const string& src, string& dst)
   const char *p = src.c_str();
   for (unsigned i = 0; i < src.size(); i++, p++) {
     if (char_needs_url_encoding(*p)) {
-      escape_char(*p, dst);
+      rgw_uri_escape_char(*p, dst);
       continue;
     }
 

diff --git a/src/rgw/rgw_common.h b/src/rgw/rgw_common.h
index cb7c1f939f9f9b7a808fe42058914e55c5254d3d..36e28d118d2c731184165b6c02098a27e39380e0 100644 (file)
--- a/src/rgw/rgw_common.h
+++ b/src/rgw/rgw_common.h
@@ -1768,6 +1768,7 @@ extern bool verify_object_permission(struct req_state *s,
 extern bool verify_object_permission(struct req_state *s, int perm);
 /** Convert an input URL into a sane object name
  * by converting %-escaped strings into characters, etc*/
+extern void rgw_uri_escape_char(char c, string& dst);
 extern bool url_decode(const string& src_str, string& dest_str, bool in_query = false);
 extern void url_encode(const string& src, string& dst, bool in_query = false);
 

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index ff03d24054bb7e9d5dcec8b8eae76b7dce40fff8..ab927b7b0e6ce5ba0195509137fd4e09f5d88bff 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -2861,6 +2861,37 @@ static inline bool is_base64_for_content_md5(unsigned char c) {
   return (isalnum(c) || isspace(c) || (c == '+') || (c == '/') || (c == '='));
 }
 
+static bool char_needs_aws4_escaping(char c)
+{
+  if ((c >= 'a' && c <= 'z') ||
+      (c >= 'A' && c <= 'Z') ||
+      (c >= '0' && c <= '9')) {
+    return false;
+  }
+
+  switch (c) {
+    case '-':
+    case '_':
+    case '.':
+    case '~':
+      return false;
+  }
+  return true;
+}
+
+static void aws4_uri_encode(const string& src, string& dst)
+{
+  const char *p = src.c_str();
+  for (unsigned i = 0; i < src.size(); i++, p++) {
+    if (char_needs_aws4_escaping(*p)) {
+      rgw_uri_escape_char(*p, dst);
+      continue;
+    }
+
+    dst.append(p, 1);
+  }
+}
+
 /*
  * handle v4 signatures (rados auth only)
  */
@@ -3063,7 +3094,13 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
       getline(kv, key, '=');
       getline(kv, val, '=');
       if (!using_qs || key != "X-Amz-Signature") {
-       canonical_qs_map[key] = val;
+        string encoded_key;
+        string encoded_val;
+
+        aws4_uri_encode(key, encoded_key);
+        aws4_uri_encode(val, encoded_val);
+
+       canonical_qs_map[encoded_key] = encoded_val;
       }
     }