Unverified Commit 0d2c1602 authored by John DiSanti's avatar John DiSanti Committed by GitHub
Browse files

Fix signing of UTF-8 header values (#710) 

* Fix signing of UTF-8 header values

* Update changelog
parent 06650402

aws/SDK_CHANGELOG.md

+1 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ vNext (Month Day, Year) 
- Add IMDS credential provider to `aws-config` (smithy-rs#709)

- Update event stream `Receiver`s to be `Send` (aws-sdk-rust#224)

- Add `sts::AssumeRoleProvider` to `aws-config` (#703, aws-sdk-rust#3)

- :bug: Fix panic when signing non-ASCII header values (smithy-rs#708, aws-sdk-rust#226)



v0.0.18-alpha (September 14th, 2021)

=======================

aws/rust-runtime/aws-sigv4/src/http_request/canonical_request.rs

+6 −1
Original line number Diff line number Diff line
@@ -317,7 +317,12 @@ impl<'a> fmt::Display for CanonicalRequest<'a> { 
            // a missing header is a bug, so we should panic.

            let value = &self.headers[&header.0];

            write!(f, "{}:", header.0.as_str())?;

            writeln!(f, "{}", value.to_str().unwrap())?;

            writeln!(

                f,

                "{}",

                std::str::from_utf8(value.as_bytes())

                    .expect("SDK request header values are valid UTF-8")

            )?;

        }

        writeln!(f)?;

        // write out the signed headers

aws/rust-runtime/aws-sigv4/src/http_request/sign.rs

+50 −0
Original line number Diff line number Diff line
@@ -370,6 +370,56 @@ mod tests { 
        assert_req_eq!(expected, signed);

    }



    #[test]

    fn test_sign_headers_utf8() {

        let settings = SigningSettings::default();

        let params = SigningParams {

            access_key: "AKIDEXAMPLE",

            secret_key: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",

            security_token: None,

            region: "us-east-1",

            service_name: "service",

            date_time: parse_date_time("20150830T123600Z").unwrap(),

            settings,

        };



        let original = http::Request::builder()

            .uri("https://some-endpoint.some-region.amazonaws.com")

            .header("some-header", HeaderValue::from_str("テスト").unwrap())

            .body("")

            .unwrap();

        let signable = SignableRequest::from(&original);

        let out = sign(signable, &params).unwrap();

        assert_eq!(

            "4596b207a7fc6bdf18725369bc0cd7022cf20efbd2c19730549f42d1a403648e",

            out.signature

        );



        let mut signed = original;

        out.output.apply_to_request(&mut signed);



        let mut expected = http::Request::builder()

            .uri("https://some-endpoint.some-region.amazonaws.com")

            .header("some-header", HeaderValue::from_str("テスト").unwrap())

            .header(

                "x-amz-date",

                HeaderValue::from_str("20150830T123600Z").unwrap(),

            )

            .header(

                "authorization",

                HeaderValue::from_str(

                    "AWS4-HMAC-SHA256 \

                        Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, \

                        SignedHeaders=host;some-header;x-amz-date, \

                        Signature=4596b207a7fc6bdf18725369bc0cd7022cf20efbd2c19730549f42d1a403648e",

                )

                .unwrap(),

            )

            .body("")

            .unwrap();

        assert_req_eq!(expected, signed);

    }



    #[test]

    fn apply_signing_instructions_headers() {

        let mut headers = HeaderMap::new();

aws/rust-runtime/aws-sigv4/src/http_request/test.rs

+1 −1
Original line number Diff line number Diff line
@@ -54,7 +54,7 @@ fn test_parsed_request(name: &str, ext: &str) -> Request<Bytes> { 
    }

}



pub(crate) fn make_headers_comparable(request: &mut Request<Bytes>) {

pub(crate) fn make_headers_comparable<B>(request: &mut Request<B>) {

    for (_name, value) in request.headers_mut() {

        value.set_sensitive(false);

    }