romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 16:28:59 +03:00
Code Issues Projects Releases Packages Wiki Activity

lib: fix aws-sigv4 having date header twice in some cases

Browse source 
When the user was providing the header X-XXX-Date, the header was
re-added during signature computation, and we had it twice in the
request.

Reported-by: apparentorder@users.noreply.github.com

Signed-off-by: Matthias Gatto <matthias.gatto@outscale.com>

Fixes: https://github.com/curl/curl/issues/11738
Closes: https://github.com/curl/curl/pull/11754
This commit is contained in:
Matthias Gatto 2023-08-28 13:38:20 +02:00 • committed by Jay Satiro
parent 7f597ca12c
commit b137634ba3
5 changed files with 150 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

16
lib/http_aws_sigv4.c
View file

@ -214,15 +214,11 @@ static CURLcode make_headers(struct Curl_easy *data,
if(!tmp_head)
goto fail;
head = tmp_head;
*date_header = curl_maprintf("%s: %s", date_hdr_key, timestamp);
*date_header = curl_maprintf("%s: %s\r\n", date_hdr_key, timestamp);
}
else {
char *value;
*date_header = strdup(*date_header);
if(!*date_header)
goto fail;
value = strchr(*date_header, ':');
if(!value)
goto fail;
@ -231,6 +227,7 @@ static CURLcode make_headers(struct Curl_easy *data,
++value;
strncpy(timestamp, value, TIMESTAMP_SIZE - 1);
timestamp[TIMESTAMP_SIZE - 1] = 0;
*date_header = NULL;
}
/* alpha-sort in a case sensitive manner */
@ -612,14 +609,19 @@ CURLcode Curl_output_aws_sigv4(struct Curl_easy *data, bool proxy)
"Credential=%s/%s, "
"SignedHeaders=%s, "
"Signature=%s\r\n"
"%s\r\n"
/*
* date_header is added here, only if it wasn't
* user-specified (using CURLOPT_HTTPHEADER).
* date_header includes \r\n
*/
"%s"
"%s", /* optional sha256 header includes \r\n */
provider0,
user,
credential_scope,
Curl_dyn_ptr(&signed_headers),
sha_hex,
date_header,
date_header ? date_header : "",
content_sha256_hdr);
if(!auth_headers) {
goto fail;