gaul / s3proxy

Access other storage backends via the S3 API
Apache License 2.0
1.74k stars 223 forks source link

Wrong checksum calculation in handleUploadPart #576

Open akshay-sawant-bh opened 10 months ago

akshay-sawant-bh commented 10 months ago

if (contentMD5String != null) { try { contentMD5 = HashCode.fromBytes( Base64.getDecoder().decode(contentMD5String)); } catch (IllegalArgumentException iae) { throw new S3Exception(S3ErrorCode.INVALID_DIGEST, iae); } if (contentMD5.bits() != MD5.bits()) { throw new S3Exception(S3ErrorCode.INVALID_DIGEST); } }

In handleUploadPart the code only checks for 128 bits and not the actual value, so even if someone sends a wrong MD5 base64 encoded string of file which is 128 bits the code will not throw an error.

akshay-sawant-bh commented 10 months ago

This is for azureblob looks like we are not sending the actual content-MD5 received along with the Payload in case of azure