fix: url-encode cache name and key in presigned urls #44
Conversation
MomentoTest/MomentoSignerTest.cs
Outdated
| var url = signer.CreatePresignedUrl("foobar.com", new SigningRequest("testCacheName", "///", CacheOperation.GET, expiryEpochSeconds)); | ||
|
|
||
| Uri uriResult; | ||
| bool result = Uri.TryCreate(url, UriKind.Absolute, out uriResult); | ||
| Assert.True(result); | ||
| Assert.Equal(Uri.UriSchemeHttps, uriResult.Scheme); | ||
| Assert.StartsWith("https://foobar.com/cache/get/testCacheName/%2f%2f%2f?token=", url); |
There was a problem hiding this comment.
Can we do a more exhaustive test? I know some library won't percent encode / char.
There was a problem hiding this comment.
We don't need to encode !, *, ( and ) (.NET actually won't convert them https://docs.microsoft.com/en-us/dotnet/api/system.net.webutility.urlencode?view=net-6.0#remarks)
Tested with a token for "key": "._-*!()", it worked without url-encoding them.
curl https://cache.developer-wanda-dev.preprod.a.momentohq.com/cache/set/cache/._-\*\!\(\)\?token\=eyJhbGciOiJSUzI1NiIsImtpZCI6Imx5anp3ZGF2bSJ9.eyJjYWNoZSI6ImNhY2hlIiwibWV0aG9kIjpbIkdFVCIsIlNFVCJdLCJleHAiOjI2NDk4MDU2MjUsInR0bCI6MzYwMCwia2V5IjoiLl8tKiEoKSJ9.JCrQ6GtrRrQSzNioF5EU_xcY9v1xpOPMKl1JnS5UAgSbAyU6wAFGE8r0UwxIxNDNEKPRmgy84w97gZavJAf3nCJpHOPP9GAKm5ipQhK-ZCZbt6Ok9IvRnX_Uc23-aiDH10av0QwybQ8l-GTbCkE7U-biWihzD5Yv35zBzkpUOf-fgCzSUIR3PyspcrTE483dDowc_nYbSXJjfZzwdhZa1Yk8hRy4TAWMjh8LHqW2wZ-e8lQpnRbdt7NVtD7KjPQaL0GNNd4yjO33bcak2LqDCTJDQtjtfwk_DkpcU46SCw9fh9nhhRzW6BuWn0BaqUt8oatWHGLCOrAMCqwLsyO3mA\&ttl_milliseconds\=3600000 -d '"'`echo something | base64`'"'
{
"result": "Ok",
"message": ""
}
There was a problem hiding this comment.
Btw in the python SDK example (e.g. https://github.com/momentohq/client-sdk-python/blob/main/tests/test_momento_signer.py#L86) I think we need to escape \?
%5C (i.e. encoded \) is missing here https://github.com/momentohq/client-sdk-python/blob/main/tests/test_momento_signer.py#L92
There was a problem hiding this comment.
Oh ha good catch, I need to double-escape that backslash.
Closes #43