storage: V4 getSignedUrl sorts canonical headers with localeCompare, so they disagree with X-Goog-SignedHeaders

Aperta Adatta ai principianti
  • Qualcosa non va?
#9,840 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@itsrayeedscodespace ci sta già lavorando.

Dal 8/11/2026.

  • #9841 di @itsrayeedscodespace — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
82/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
node.js, typescript
Ambito
backend, security

Direzione di ricerca

Inizia in handwritten/storage/src/signer.ts, in corrispondenza di URLSigner.getCanonicalHeaders, e confronta l’ordinamento degli header con il semplice .sort() usato per signedHeaders. Verifica se i test del signer di storage coprono i nomi degli header contenenti - e _ e l’ordinamento sensibile alla locale. Il lavoro è completato quando il blocco degli header canonici segue l’ordine dei code point e corrisponde all’elenco degli header firmati.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

api: storage
Please make sure you have searched for information in the following guides.
Library Name

@google-cloud/storage

A screenshot that you have tested with "Try this API".

Not applicable: V4 URL signing happens entirely in the client library; no API call is involved.

Link to the code that reproduces this issue. A link to a public Github Repository or gist with a minimal reproduction.

https://gist.github.com/trackoor/dc977f474cf9a692628c158959bbef2c

A step-by-step description of how to reproduce the issue, based on the linked reproduction.
  1. npm install (installs @google-cloud/storage 8.4.0), Node.js v26.13.0 (full ICU), Linux.
  2. node index.js prints the canonical request that gets signed, for extensionHeaders: {"x-goog-meta-a_b": "1", "x-goog-meta-a-b": "2"}:
GET
/test-bucket/test-object
X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=test%40example.iam.gserviceaccount.com%2F20261107%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20261107T105715Z&X-Goog-Expires=60&X-Goog-SignedHeaders=host%3Bx-goog-meta-a-b%3Bx-goog-meta-a_b
host:storage.googleapis.com
x-goog-meta-a_b:1
x-goog-meta-a-b:2

host;x-goog-meta-a-b;x-goog-meta-a_b
UNSIGNED-PAYLOAD
  1. LANG=lt_LT.UTF-8 node index.js lt does the same for x-goog-meta-y and x-goog-meta-j:
host:storage.googleapis.com
x-goog-meta-y:1
x-goog-meta-j:2

host;x-goog-meta-j;x-goog-meta-y
A clear and concise description of what the bug is, and what you expected to happen.

The canonical headers block is in a different order from the signed headers list in the same canonical request, so GCS computes a different signature and rejects the URL. Expected: canonical headers in code point order, matching X-Goog-SignedHeaders:

host:storage.googleapis.com
x-goog-meta-a-b:2
x-goog-meta-a_b:1

host;x-goog-meta-a-b;x-goog-meta-a_b
A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **

The V4 canonical request docs say headers are sorted by name "using a lexicographical sort by code point value": https://cloud.google.com/storage/docs/authentication/canonical-requests

URLSigner.getCanonicalHeaders in handwritten/storage/src/signer.ts (line 401 on main at 97b0d64daa8ea9407756aee646b8ac1bf19aec80) sorts with a[0].localeCompare(b[0]), which puts _ before - and follows the process locale, while signedHeaders uses a plain .sort().

Credit: https://ucsbplse.github.io/

Lingua principale
TypeScript
Stelle
3.2k
Fork
732
Merge medio
3g 7h
PR unite (30g)
117

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di googleapis/google-cloud-node

Tutte le issue di googleapis/google-cloud-node

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.