Unverified Commit be630b26 authored by Rupert's avatar Rupert Committed by GitHub
Browse files

Prevent reading the entire body of a request if unnecessary (#156) 



Prior to this, we were reading an entire UNSIGNED_PAYLOAD request into
memory, even though this was not required for verification of the
signature.

Co-authored-by: default avatarRupert Rutledge <rupertr@thestartupfactory.tech>
parent ac29014f

crates/s3s/src/ops/signature.rs

+12 −9
Original line number Diff line number Diff line
@@ -276,24 +276,27 @@ impl SignatureContext<'_> { 
                    sig_v4::Payload::Empty

                };

                sig_v4::create_canonical_request(method, uri_path, query_strings, &headers, payload)

            } else if matches!(amz_content_sha256, AmzContentSha256::UnsignedPayload) {

                sig_v4::create_canonical_request(method, uri_path, query_strings, &headers, sig_v4::Payload::Unsigned)

            } else {

                let bytes = super::extract_full_body(self.content_length, self.req_body).await?;



                if bytes.len() < 1024 {

                    debug!(len=?bytes.len(), body=?bytes, "extracted full body");

                } else {

                    debug!(len=?bytes.len(), "extracted full body");

                }



                let payload = if matches!(amz_content_sha256, AmzContentSha256::UnsignedPayload) {

                    sig_v4::Payload::Unsigned

                } else if bytes.is_empty() {

                    sig_v4::Payload::Empty

                if bytes.is_empty() {

                    sig_v4::create_canonical_request(method, uri_path, query_strings, &headers, sig_v4::Payload::Empty)

                } else {

                    sig_v4::Payload::SingleChunk(&bytes)

                };



                sig_v4::create_canonical_request(method, uri_path, query_strings, &headers, payload)

                    sig_v4::create_canonical_request(

                        method,

                        uri_path,

                        query_strings,

                        &headers,

                        sig_v4::Payload::SingleChunk(&bytes),

                    )

                }

            };



            let region = authorization.credential.aws_region;