search

exoscale / egoscale

exoscale golang bindings
https://pkg.go.dev/github.com/exoscale/egoscale/v3
Apache License 2.0
31 stars 14 forks source link

security: use escaped path in signature to align with public API #555

Closed kobajagi closed 2 years ago

kobajagi commented 2 years ago

This PR fixes a bug with signature validation on some API calls.

One component that is signed is the URL path parameter. Public API checks signature against urlencoded path while egoscale signs unencoded one. This means public API would fail signature check when path component has unsafe character in url (observed for SSH key name with space character, endpoint: https://<zone>.exoscale.com/v2/ssh-key/some%20key). This PR aligns request signature logic to the public API.

shortcut-integration[bot] commented 2 years ago

This pull request has been linked to Shortcut Story #47588: auth: urldecode path / query params before checking signature.