moxiecode / moxie

Pollyfills for XHR2 and File API
GNU Affero General Public License v3.0
483 stars 134 forks source link

Flash FormData upload to S3 generates duplicate filename param and bombs out upload #165

Open KnownSubset opened 7 years ago

KnownSubset commented 7 years ago

Trying to have Flash send mOxie.FormData a mOxie.File up to S3 causes a duplicate input field to be written out for the filename.

403 error response received from AWS.

<Error>
  <Code>AccessDenied</Code>
  <Message>Invalid according to Policy: Extra input fields: filename</Message>
  <RequestId>A109BA6CF4DCA803</RequestId>
  <HostId>wJbsevGMqL6yzG7QlSWKpBXNbXE25Ep5UnmZKuRhCRP9udjw/Lz2pR2aZb+KXafAXvhRfktDsaA=</HostId>
</Error>

Request payload:

------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="Filename"

fonts.pdf
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="key"

development_bucket/fonts.pdf
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="x-amz-server-side-encryption"

AES256
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="policy"

eyJleH....
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="x-amz-credential"

AKIAJQGS5W3QIWU46C3Q/20161006/us-east-1/s3/aws4_request
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="x-amz-algorithm"

AWS4-HMAC-SHA256
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="x-amz-date"

20161006T213545Z
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="x-amz-signature"

b4187....
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="file"; filename="fonts.pdf"
Content-Type: application/octet-stream

------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7
Content-Disposition: form-data; name="Upload"

Submit Query
------------Ef1ei4Ij5KM7GI3gL6cH2Ij5Ij5KM7--

I believe it has to do with Flash auto-inserting the Filename input field and the filename being included with blob.