search

Azure / azure-storage-php

Microsoft Azure Storage Library for PHP
MIT License
217 stars 198 forks source link

URL decoding in the signature helper results in paths containing a '+' sign not being verified correctly #352

Open shineability opened 7 months ago

shineability commented 7 months ago

Which service(blob, file, queue, table) does this issue concern?

Blob, but the issue occurs in the Common package...

Which version of the SDK was used?

What problem was encountered?

When your blob/resource name has a + character in it , the signature verification fails.

Steps to reproduce the issue?

Generate a SAS token with any resource containing a + character.

$resourceContainingPlusCharacter = 'package-test/azure+logo-plus.jpg';

$token = BlobSharedAccessSignatureHelper::generateBlobServiceSharedAccessSignatureToken(
    Resources::RESOURCE_TYPE_BLOB, 
    $resourceContainingPlusCharacter,
    ...
);

https://github.com/Azure/azure-storage-php/blob/4cd7470e517022faa80bed98d3c7518aa512ea97/azure-storage-common/src/Common/SharedAccessSignatureHelper.php#L329

Using urldecode here decodes a + to a space, which changes the resource to package-test/azure logo-plus.jpg before generating the signature.

Have you found a mitigation/solution?

Using rawurldecode fixes the issue, but not decoding also works, not sure why the resource needs to be decoded here in the first place?