1+ /*
2+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+ *
4+ * Licensed under the Apache License, Version 2.0 (the "License").
5+ * You may not use this file except in compliance with the License.
6+ * A copy of the License is located at
7+ *
8+ * http://aws.amazon.com/apache2.0
9+ *
10+ * or in the "license" file accompanying this file. This file is distributed
11+ * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+ * express or implied. See the License for the specific language governing
13+ * permissions and limitations under the License.
14+ */
15+
16+ package software .amazon .awssdk .auth .signer ;
17+
18+ import static org .assertj .core .api .Assertions .assertThat ;
19+ import static org .junit .jupiter .api .Assertions .assertDoesNotThrow ;
20+
21+ import java .net .URI ;
22+ import java .nio .ByteBuffer ;
23+ import java .time .Clock ;
24+ import java .time .Instant ;
25+ import java .time .ZoneOffset ;
26+ import java .util .concurrent .ThreadLocalRandom ;
27+ import org .junit .jupiter .api .Test ;
28+ import software .amazon .awssdk .auth .credentials .AwsBasicCredentials ;
29+ import software .amazon .awssdk .auth .signer .params .Aws4PresignerParams ;
30+ import software .amazon .awssdk .auth .signer .params .AwsS3V4SignerParams ;
31+ import software .amazon .awssdk .core .interceptor .ExecutionAttributes ;
32+ import software .amazon .awssdk .core .sync .RequestBody ;
33+ import software .amazon .awssdk .http .SdkHttpFullRequest ;
34+ import software .amazon .awssdk .http .SdkHttpMethod ;
35+ import software .amazon .awssdk .regions .Region ;
36+
37+ class AwsS3V4SignerTest {
38+ private static final Clock UTC_EPOCH_CLOCK = Clock .fixed (Instant .EPOCH , ZoneOffset .UTC );
39+
40+ @ Test
41+ public void signWithParams_urlsAreNotNormalized () {
42+ byte [] bytes = new byte [1000 ];
43+ ThreadLocalRandom .current ().nextBytes (bytes );
44+ ByteBuffer buffer = ByteBuffer .wrap (bytes );
45+ URI target = URI .create ("https://test.com/./foo" );
46+
47+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
48+ .contentStreamProvider (RequestBody .fromByteBuffer (buffer )
49+ .contentStreamProvider ())
50+ .method (SdkHttpMethod .GET )
51+ .uri (target )
52+ .encodedPath (target .getPath ())
53+ .build ();
54+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
55+ SdkHttpFullRequest signedRequest =
56+ signer .sign (request ,
57+ AwsS3V4SignerParams .builder ()
58+ .awsCredentials (AwsBasicCredentials .create ("akid" , "skid" ))
59+ .signingRegion (Region .US_WEST_2 )
60+ .signingName ("s3" )
61+ .signingClockOverride (UTC_EPOCH_CLOCK )
62+ .build ());
63+
64+ assertThat (signedRequest .firstMatchingHeader ("Authorization" ))
65+ .hasValue ("AWS4-HMAC-SHA256 Credential=akid/19700101/us-west-2/s3/aws4_request, "
66+ + "SignedHeaders=host;x-amz-content-sha256;x-amz-date, "
67+ + "Signature=a3b97f9de337ab254f3b366c3d0b3c67016d2d8d8ba7e0e4ddab0ccebe84992a" );
68+ }
69+
70+ @ Test
71+ public void signWithExecutionAttributes_urlsAreNotNormalized () {
72+ byte [] bytes = new byte [1000 ];
73+ ThreadLocalRandom .current ().nextBytes (bytes );
74+ ByteBuffer buffer = ByteBuffer .wrap (bytes );
75+ URI target = URI .create ("https://test.com/./foo" );
76+
77+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
78+ .contentStreamProvider (RequestBody .fromByteBuffer (buffer )
79+ .contentStreamProvider ())
80+ .method (SdkHttpMethod .GET )
81+ .uri (target )
82+ .encodedPath (target .getPath ())
83+ .build ();
84+ ExecutionAttributes attributes =
85+ ExecutionAttributes .builder ()
86+ .put (AwsSignerExecutionAttribute .AWS_CREDENTIALS ,
87+ AwsBasicCredentials .create ("akid" , "skid" ))
88+ .put (AwsSignerExecutionAttribute .SIGNING_REGION , Region .US_WEST_2 )
89+ .put (AwsSignerExecutionAttribute .SERVICE_SIGNING_NAME , "s3" )
90+ .put (AwsSignerExecutionAttribute .SIGNING_CLOCK , UTC_EPOCH_CLOCK )
91+ .build ();
92+
93+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
94+ SdkHttpFullRequest signedRequest = signer .sign (request , attributes );
95+
96+ assertThat (signedRequest .firstMatchingHeader ("Authorization" ))
97+ .hasValue ("AWS4-HMAC-SHA256 Credential=akid/19700101/us-west-2/s3/aws4_request, "
98+ + "SignedHeaders=host;x-amz-content-sha256;x-amz-date, "
99+ + "Signature=a3b97f9de337ab254f3b366c3d0b3c67016d2d8d8ba7e0e4ddab0ccebe84992a" );
100+ }
101+
102+ @ Test
103+ public void presignWithParams_urlsAreNotNormalized () {
104+ byte [] bytes = new byte [1000 ];
105+ ThreadLocalRandom .current ().nextBytes (bytes );
106+ ByteBuffer buffer = ByteBuffer .wrap (bytes );
107+ URI target = URI .create ("https://test.com/./foo" );
108+
109+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
110+ .contentStreamProvider (RequestBody .fromByteBuffer (buffer )
111+ .contentStreamProvider ())
112+ .method (SdkHttpMethod .GET )
113+ .uri (target )
114+ .encodedPath (target .getPath ())
115+ .build ();
116+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
117+
118+ SdkHttpFullRequest signedRequest =
119+ signer .presign (request ,
120+ Aws4PresignerParams .builder ()
121+ .awsCredentials (AwsBasicCredentials .create ("akid" , "skid" ))
122+ .signingRegion (Region .US_WEST_2 )
123+ .signingName ("s3" )
124+ .signingClockOverride (UTC_EPOCH_CLOCK )
125+ .build ());
126+
127+ assertThat (signedRequest .firstMatchingRawQueryParameter ("X-Amz-Signature" ))
128+ .hasValue ("3a9d36d37e9a554b7a3803f58ee7539b5d1f52fdfe89ce6fd40fb25762a35ec3" );
129+ }
130+
131+ @ Test
132+ public void presignWithExecutionAttributes_urlsAreNotNormalized () {
133+ byte [] bytes = new byte [1000 ];
134+ ThreadLocalRandom .current ().nextBytes (bytes );
135+ ByteBuffer buffer = ByteBuffer .wrap (bytes );
136+ URI target = URI .create ("https://test.com/./foo" );
137+
138+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
139+ .contentStreamProvider (RequestBody .fromByteBuffer (buffer )
140+ .contentStreamProvider ())
141+ .method (SdkHttpMethod .GET )
142+ .uri (target )
143+ .encodedPath (target .getPath ())
144+ .build ();
145+ ExecutionAttributes attributes =
146+ ExecutionAttributes .builder ()
147+ .put (AwsSignerExecutionAttribute .AWS_CREDENTIALS ,
148+ AwsBasicCredentials .create ("akid" , "skid" ))
149+ .put (AwsSignerExecutionAttribute .SIGNING_REGION , Region .US_WEST_2 )
150+ .put (AwsSignerExecutionAttribute .SERVICE_SIGNING_NAME , "s3" )
151+ .put (AwsSignerExecutionAttribute .SIGNING_CLOCK , UTC_EPOCH_CLOCK )
152+ .build ();
153+
154+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
155+ SdkHttpFullRequest signedRequest = signer .presign (request , attributes );
156+
157+ assertThat (signedRequest .firstMatchingRawQueryParameter ("X-Amz-Signature" ))
158+ .hasValue ("3a9d36d37e9a554b7a3803f58ee7539b5d1f52fdfe89ce6fd40fb25762a35ec3" );
159+ }
160+
161+ @ Test
162+ public void signWithParams_doesNotFailWithEncodedCharacters () {
163+ URI target = URI .create ("https://test.com/%20foo" );
164+
165+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
166+ .method (SdkHttpMethod .GET )
167+ .uri (target )
168+ .encodedPath (target .getPath ())
169+ .build ();
170+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
171+ assertDoesNotThrow (() ->
172+ signer .sign (request ,
173+ AwsS3V4SignerParams .builder ()
174+ .awsCredentials (AwsBasicCredentials .create ("akid" , "skid" ))
175+ .signingRegion (Region .US_WEST_2 )
176+ .signingName ("s3" )
177+ .build ()));
178+ }
179+
180+ @ Test
181+ public void signWithExecutionAttributes_doesNotFailWithEncodedCharacters () {
182+ URI target = URI .create ("https://test.com/%20foo" );
183+
184+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
185+ .method (SdkHttpMethod .GET )
186+ .uri (target )
187+ .encodedPath (target .getPath ())
188+ .build ();
189+ ExecutionAttributes attributes =
190+ ExecutionAttributes .builder ()
191+ .put (AwsSignerExecutionAttribute .AWS_CREDENTIALS ,
192+ AwsBasicCredentials .create ("akid" , "skid" ))
193+ .put (AwsSignerExecutionAttribute .SIGNING_REGION , Region .US_WEST_2 )
194+ .put (AwsSignerExecutionAttribute .SERVICE_SIGNING_NAME , "s3" )
195+ .build ();
196+
197+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
198+ assertDoesNotThrow (() -> signer .sign (request , attributes ));
199+ }
200+
201+ @ Test
202+ public void presignWithParams_doesNotFailWithEncodedCharacters () {
203+ URI target = URI .create ("https://test.com/%20foo" );
204+
205+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
206+ .method (SdkHttpMethod .GET )
207+ .uri (target )
208+ .encodedPath (target .getPath ())
209+ .build ();
210+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
211+
212+ assertDoesNotThrow (() ->
213+ signer .presign (request ,
214+ Aws4PresignerParams .builder ()
215+ .awsCredentials (AwsBasicCredentials .create ("akid" , "skid" ))
216+ .signingRegion (Region .US_WEST_2 )
217+ .signingName ("s3" )
218+ .build ()));
219+ }
220+
221+ @ Test
222+ public void presignWithExecutionAttributes_doesNotFailWithEncodedCharacters () {
223+ URI target = URI .create ("https://test.com/%20foo" );
224+
225+ SdkHttpFullRequest request = SdkHttpFullRequest .builder ()
226+ .method (SdkHttpMethod .GET )
227+ .uri (target )
228+ .encodedPath (target .getPath ())
229+ .build ();
230+ ExecutionAttributes attributes =
231+ ExecutionAttributes .builder ()
232+ .put (AwsSignerExecutionAttribute .AWS_CREDENTIALS ,
233+ AwsBasicCredentials .create ("akid" , "skid" ))
234+ .put (AwsSignerExecutionAttribute .SIGNING_REGION , Region .US_WEST_2 )
235+ .put (AwsSignerExecutionAttribute .SERVICE_SIGNING_NAME , "s3" )
236+ .build ();
237+
238+ AwsS3V4Signer signer = AwsS3V4Signer .create ();
239+ assertDoesNotThrow (() -> signer .presign (request , attributes ));
240+ }
241+ }
0 commit comments