storage: V4 getSignedUrl sorts canonical headers with localeCompare, so they disagree with X-Goog-SignedHeaders

Aberta Para iniciantes
  • Algo errado?
#9,840 1 comentário 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@itsrayeedscodespace já está trabalhando nisso.

Desde 8/11/2026.

  • #9841 de @itsrayeedscodespace — aberto

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
82/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
node.js, typescript
Domínio
backend, security

Direção de pesquisa

Comece em handwritten/storage/src/signer.ts, em URLSigner.getCanonicalHeaders, e compare a ordenação dos cabeçalhos com o .sort() simples usado para signedHeaders. Verifique se os testes do signer de storage cobrem nomes de cabeçalho que contêm - e _, e a ordenação sensível à localidade. A tarefa estará concluída quando o bloco de cabeçalhos canônicos seguir a ordem dos pontos de código e corresponder à lista de cabeçalhos assinados.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

api: storage
Please make sure you have searched for information in the following guides.
Library Name

@google-cloud/storage

A screenshot that you have tested with "Try this API".

Not applicable: V4 URL signing happens entirely in the client library; no API call is involved.

Link to the code that reproduces this issue. A link to a public Github Repository or gist with a minimal reproduction.

https://gist.github.com/trackoor/dc977f474cf9a692628c158959bbef2c

A step-by-step description of how to reproduce the issue, based on the linked reproduction.
  1. npm install (installs @google-cloud/storage 8.4.0), Node.js v26.13.0 (full ICU), Linux.
  2. node index.js prints the canonical request that gets signed, for extensionHeaders: {"x-goog-meta-a_b": "1", "x-goog-meta-a-b": "2"}:
GET
/test-bucket/test-object
X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=test%40example.iam.gserviceaccount.com%2F20261107%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20261107T105715Z&X-Goog-Expires=60&X-Goog-SignedHeaders=host%3Bx-goog-meta-a-b%3Bx-goog-meta-a_b
host:storage.googleapis.com
x-goog-meta-a_b:1
x-goog-meta-a-b:2

host;x-goog-meta-a-b;x-goog-meta-a_b
UNSIGNED-PAYLOAD
  1. LANG=lt_LT.UTF-8 node index.js lt does the same for x-goog-meta-y and x-goog-meta-j:
host:storage.googleapis.com
x-goog-meta-y:1
x-goog-meta-j:2

host;x-goog-meta-j;x-goog-meta-y
A clear and concise description of what the bug is, and what you expected to happen.

The canonical headers block is in a different order from the signed headers list in the same canonical request, so GCS computes a different signature and rejects the URL. Expected: canonical headers in code point order, matching X-Goog-SignedHeaders:

host:storage.googleapis.com
x-goog-meta-a-b:2
x-goog-meta-a_b:1

host;x-goog-meta-a-b;x-goog-meta-a_b
A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **

The V4 canonical request docs say headers are sorted by name "using a lexicographical sort by code point value": https://cloud.google.com/storage/docs/authentication/canonical-requests

URLSigner.getCanonicalHeaders in handwritten/storage/src/signer.ts (line 401 on main at 97b0d64daa8ea9407756aee646b8ac1bf19aec80) sorts with a[0].localeCompare(b[0]), which puts _ before - and follows the process locale, while signedHeaders uses a plain .sort().

Credit: https://ucsbplse.github.io/

Linguagem predominante
TypeScript
Estrelas
3.2k
Forks
732
Merge médio
3d 7h
PRs com merge (30d)
117

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de googleapis/google-cloud-node

Todas as issues de googleapis/google-cloud-node

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.