astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-04 14:52:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: honor header checksum when x-amz-trailer is advertised on non-trailer chunked PUT (#107)

Browse Source 
The AWS Java SDK v2, with chunked encoding enabled (its default), sends a
PutObject as a non-trailer signed aws-chunked stream
(x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD). When a checksum
algorithm is set it puts the precomputed value in the x-amz-checksum-crc32
header, yet still advertises the checksum in x-amz-trailer even though no
trailer chunk is ever sent.

GetContentChecksum treated any x-amz-trailer-advertised checksum as trailing
with an empty value, deferring it to a trailer. For the non-trailer auth type
the handler sets req.Trailer = nil, so at EOF the hash.Reader looked the value
up in a nil trailer, got "", and returned XAmzContentChecksumMismatch (HTTP
400) even though the correct value sat in the request header. Real S3 accepts
the request, and disabling chunked encoding removed the trailer advertisement,
matching the reported symptom.

Honor the header value directly when a trailer-advertised checksum is already
present in the request headers; fall back to trailing delivery only when the
header is absent. When the header carries the checksum but it does not parse,
reject the request with ErrInvalidChecksum instead of falling through to a
no-validation path, so a malformed client-supplied checksum is never silently
dropped. This also restores the checksum echo on the response and the stored
value, while keeping genuine trailer uploads and wrong-checksum rejection
intact.

Fixes #107.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L7qJqWwy8oFA6aCXWRzXQe
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-09-06 22:28:18 +08:00
parent e7d0e62f16
commit 6a9b5d6763
3 changed files with 226 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/hash/checksum.go
+19 -1
View File
@@ -698,7 +698,25 @@ func GetContentChecksum(h http.Header) (*Checksum, error) {
for _, t := range BaseChecksumTypes {
if strings.EqualFold(t.Key(), header) {
duplicates = res != nil
res = NewChecksumWithType(t|ChecksumTrailing, "")
// A checksum can be advertised via x-amz-trailer while its
// value is still delivered in the request headers. The AWS
// Java SDK v2 does this on chunked (aws-chunked) uploads:
// it sends STREAMING-AWS4-HMAC-SHA256-PAYLOAD (no trailer),
// puts the precomputed value in x-amz-checksum-*, yet still
// lists it in x-amz-trailer, so no trailer ever arrives.
// When the value is present as a header, honor it directly
// instead of waiting for a trailer that will never be read.
if v := h.Get(t.Key()); v != "" {
res = NewChecksumWithType(t, v)
if res == nil {
// The value is supplied in the header but does
// not parse. A malformed client-supplied checksum
// is an error, not a reason to skip validation.
return nil, ErrInvalidChecksum
}
} else {
res = NewChecksumWithType(t|ChecksumTrailing, "")
}
}
}
if strings.HasPrefix(strings.ToLower(header), "x-amz-checksum-") && !isSupportedChecksumHeader(header) {