Thanks to visit codestin.com
Credit goes to github.com

Skip to content

bug: PUT request on pre-signed URL with Content-MD5 does not fail when the MD5 hash does not match the content #8929

Closed
@stekycz

Description

@stekycz

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Sending a PUT request to a pre-signed URL succeeds when the Content-MD5 parameter/header value does not match the MD5 hash of the request content received.

It works as expected when using PROVIDER_OVERRIDE_S3: legacy though.

Expected Behavior

The request should fail by MD5 hash of the content not matching the expected Content-MD5 hash.

How are you starting LocalStack?

With a docker-compose file

Steps To Reproduce

const s3 = new AWS.S3({
  endpoint: 'http://localhost:4566',
  signatureVersion: 'v4', // Required for the presigned URL functionality with extra headers
  s3ForcePathStyle: true, // Do not use custom domains
});

const body = '123456';
const invalidBodyMd5AsBase64 = '123456'

const url = await s3.getSignedUrlPromise('putObject', {
  Bucket: 'test-bucket',
  Key: 'test-file',
  Expires: 3600,
  ContentMD5: invalidBodyMd5AsBase64 // Adds 'Content-MD5' parameter in query string
});

const result = await fetch(url, {
  method: 'PUT',
  body: body,
  headers: {
    'Content-Type': 'text/plain',
    'Accept': 'application/json',
    'Content-MD5': invalidBodyMd5AsBase64, // This is required, otherwise AWS refuses to accept the request
  },
});

assert(result.ok); // This should fail as the request should be denied because of miss-matching Content-MD5 hash

Environment

- OS: MacOS 13.5
- LocalStack: 2.1.0

Anything else?

No response

Metadata

Metadata

Assignees

Labels

aws:s3Amazon Simple Storage Servicestatus: backlogTriaged but not yet being worked ontype: bugBug report

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions