Eosis commented 1 month ago

Description

Reading the entire body of an S3 Payload with an x-amz-content-sha256 header value of UNSIGNED_PAYLOAD is not necessary, this PR simply avoids this when possible.

Prior to this, we were reading an entire UNSIGNED_PAYLOAD request into memory, even though this was not required for verification of the signature.

Related Issues:

155 - This doesn't prevent unbounded memory usage in the scenario of `x-amz-content-sha256` being set to the checksum of the body, but it means we don't see unbounded memory usage for the UNSIGNED_PAYLOAD variant.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Nugine commented 1 month ago

I don't have much free time recently so I'll review your PRs at weekends. The CI failure is not related to your changes. I'll fix it later, or you can have a look.

Eosis commented 1 month ago

Thanks Nugine. No worries, I can use my fork for the moment.

Eosis commented 1 month ago

Let's just merge it at the moment as I have not had time to revisit. :+1:

Nugine / s3s

Prevent Reading Entire Body of UNSIGNED_PAYLOAD Requests During Signature Calculation #156

Description

Related Issues:

155 - This doesn't prevent unbounded memory usage in the scenario of `x-amz-content-sha256` being set to the checksum of the body, but it means we don't see unbounded memory usage for the UNSIGNED_PAYLOAD variant.

Nugine / s3s

Prevent Reading Entire Body of UNSIGNED_PAYLOAD Requests During Signature Calculation #156

Description

Related Issues:

155 - This doesn't prevent unbounded memory usage in the scenario of x-amz-content-sha256 being set to the checksum of the body, but it means we don't see unbounded memory usage for the UNSIGNED_PAYLOAD variant.

155 - This doesn't prevent unbounded memory usage in the scenario of `x-amz-content-sha256` being set to the checksum of the body, but it means we don't see unbounded memory usage for the UNSIGNED_PAYLOAD variant.