fix: keep the endpoint path out of the Host header - #474
Open
eastriverlee wants to merge 1 commit into
Open
Conversation
`Region::Custom` accepts an endpoint that carries a path, and `Region::host`
keeps that path so `Bucket::url` can place the bucket and key underneath it.
`host_header` returned the same string, so the path travelled in the `Host`
header as well:
PUT /storage/v1/s3/media/0000.bin HTTP/1.1
host: project.supabase.co/storage/v1/s3
RFC 9110 §7.2 defines `Host` as `uri-host [ ":" port ]`. A server that checks
answers `400 Bad Request` with no detail, which makes every request to such an
endpoint fail and says nothing about why.
Supabase Storage's S3 endpoint is `https://<project>.supabase.co/storage/v1/s3`
and is unusable for this reason: `put_object` fails before any signature is
verified. AWS, MinIO and R2 have no path in their endpoints, so nothing here
had exercised the case.
`host_header` now takes the authority and leaves `Region::host` alone, so the
request line keeps the endpoint path it needs. Verified against a Supabase
Storage bucket, where `put_object`, `head_object`, `get_object` and
`get_object_range` all succeed after the change and only the last three are
reachable before it, and against MinIO, which is unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #473.
Region::Customaccepts an endpoint that carries a path, andRegion::hostkeeps that path soBucket::urlcan place the bucket and key underneath it.host_headerreturned the same string, so the path travelled in theHostheader as well:RFC 9110 §7.2 defines
Hostasuri-host [ ":" port ]. A server that checks answers400 Bad Requestwith no body, before any signature is verified, so every request to such an endpoint fails and nothing says why. Supabase Storage's S3 endpoint ishttps://<project>.supabase.co/storage/v1/s3and is unusable for this reason. AWS, MinIO and R2 have no path in their endpoints, so nothing had exercised the case.What changed
host_headernow takes the authority.Region::hostis untouched, so the request line keeps the endpoint path it needs, andBucket::url,path_style_hostandsubdomain_style_hostbehave as before.host_headerfeeds theHOSTheader only (request_trait.rs:406,:729), so nothing else sees the narrower value.Verification
Against a Supabase Storage bucket, before and after, with the same 300 KB object:
put_object_with_content_type400 Bad request200head_object200,content_length=300000get_object200, 300000 bytesget_object_range(0, 1023)206, 1024 bytesget_object_range(100_000, 200_000)206, 100001 bytesMinIO passes the same five before and after.
cargo fmt --all -- --checkis clean, clippy is clean forwith-tokio,tokio-rustls-tls, andcargo test --libpasses 61 with 20 ignored. Two unit tests cover the split.This change is