mirror of
https://github.com/curl/curl.git
synced 2024-11-27 05:50:21 +08:00
http_aws_sigv4: canonicalise valueless query params
Fixes #8107 Closes #12244
This commit is contained in:
parent
2c8f4c87e1
commit
bbba69dada
@ -456,6 +456,7 @@ static CURLcode canon_query(struct Curl_easy *data,
|
||||
for(i = 0; !result && (i < entry); i++, ap++) {
|
||||
size_t len;
|
||||
const char *q = ap->p;
|
||||
bool found_equals = false;
|
||||
if(!ap->len)
|
||||
continue;
|
||||
for(len = ap->len; len && !result; q++, len--) {
|
||||
@ -467,9 +468,13 @@ static CURLcode canon_query(struct Curl_easy *data,
|
||||
case '.':
|
||||
case '_':
|
||||
case '~':
|
||||
/* allowed as-is */
|
||||
result = Curl_dyn_addn(dq, q, 1);
|
||||
break;
|
||||
case '=':
|
||||
/* allowed as-is */
|
||||
result = Curl_dyn_addn(dq, q, 1);
|
||||
found_equals = true;
|
||||
break;
|
||||
case '%':
|
||||
/* uppercase the following if hexadecimal */
|
||||
@ -497,7 +502,11 @@ static CURLcode canon_query(struct Curl_easy *data,
|
||||
}
|
||||
}
|
||||
}
|
||||
if(i < entry - 1) {
|
||||
if(!result && !found_equals) {
|
||||
/* queries without value still need an equals */
|
||||
result = Curl_dyn_addn(dq, "=", 1);
|
||||
}
|
||||
if(!result && i < entry - 1) {
|
||||
/* insert ampersands between query pairs */
|
||||
result = Curl_dyn_addn(dq, "&", 1);
|
||||
}
|
||||
|
@ -38,7 +38,7 @@ debug
|
||||
aws-sigv4 with query
|
||||
</name>
|
||||
<command>
|
||||
"http://fake.fake.fake:8000/%TESTNUMBER/?name=me%&aim=b%aad&&&weirdo=*.//-" -u user:secret --aws-sigv4 "aws:amz:us-east-2:es" --connect-to fake.fake.fake:8000:%HOSTIP:%HTTPPORT
|
||||
"http://fake.fake.fake:8000/%TESTNUMBER/?name=me%&noval&aim=b%aad&&&weirdo=*.//-" -u user:secret --aws-sigv4 "aws:amz:us-east-2:es" --connect-to fake.fake.fake:8000:%HOSTIP:%HTTPPORT
|
||||
</command>
|
||||
</client>
|
||||
|
||||
@ -46,9 +46,9 @@ aws-sigv4 with query
|
||||
# Verify data after the test has been "shot"
|
||||
<verify>
|
||||
<protocol crlf="yes">
|
||||
GET /%TESTNUMBER/?name=me%&aim=b%aad&&&weirdo=*.//- HTTP/1.1
|
||||
GET /439/?name=me%&noval&aim=b%aad&&&weirdo=*.//- HTTP/1.1
|
||||
Host: fake.fake.fake:8000
|
||||
Authorization: AWS4-HMAC-SHA256 Credential=user/19700101/us-east-2/es/aws4_request, SignedHeaders=host;x-amz-date, Signature=88884e3b3142133685b2092d29d8b522b785b1a9ec9e4a90cbea83e882f8dcb6
|
||||
Authorization: AWS4-HMAC-SHA256 Credential=user/19700101/us-east-2/es/aws4_request, SignedHeaders=host;x-amz-date, Signature=cbbf4a72764e27e396730f5e56cea046d4ce862a2d91db4856fb086b92f49270
|
||||
X-Amz-Date: 19700101T000000Z
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
|
Loading…
Reference in New Issue
Block a user