S3 HEAD/GET overwrite case-insensitive user metadata collisions
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- aws, typescript
Research direction
Start with the toAwsMetadataHeaders mapper and its dbHeadObject and getObject entry points, then inspect the deterministic AWS SDK response-deserializer regression setup described in the issue. Done means case-distinct metadata keys produce a comma-delimited combined value without breaking existing header validation or missing-meta accounting.
Written by the indexing model from the issue text.
Description
Bug report
S3 HEAD and GET silently discard user-metadata values when a Storage object has case-distinct JSON keys with the same case-insensitive header name.
Reproduction
- Upload an object through the ordinary Storage API with user metadata
{"Title":"first","title":"second"}(thex-metadataheader contains its base64-encoded JSON). - Read it through S3
HeadObjectorGetObject.
The AWS SDK returns Metadata: { title: "second" }, with no MissingMeta indication. The first value is lost in the response even though both entries are valid strings.
Expected: Metadata: { title: "first,second" }. Amazon S3 documents that REST metadata retrieval combines same-name headers, ignoring case, into a comma-delimited list.
Cause and local proof
On current master 76b70ba80e7c171d6b534db3c65430467a82f4bd, toAwsMetadataHeaders lowercases each name and overwrites the previous value. Both dbHeadObject and getObject use this mapper.
A deterministic regression using the actual AWS SDK response deserializer and production mapper fails on this revision (expected "first,second", received "second") and passes when valid colliding values are combined. The test uses in-memory database/backend boundaries, dummy SDK credentials, and no network or running services. Existing header validation and x-amz-missing-meta accounting can remain intact, including the limit on the combined header value.
- Dominant language
- TypeScript
- Stars
- 1.3k
- Forks
- 314
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 89
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/storage
-
The sample application in storage article points to wrong URLMay be free again @prasadf18 claimed this 200 days ago, and no pull request is open. Opendocumentation
Difficulty 1/5 Under an hour Newbie friendliness 62/100
supabase/storage#557 · 1 comment ·
Maintainers usually reply within 1 day
-
S3 HeadObject ignores conditional request headersPossibly taken @RaphaelFakhri claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
S3 PutObject ignores Content-MD5 integrity checksPossibly taken @ferhatelmas claimed this 7 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
supabase/storage#1561 · 1 assignee ·
Maintainers usually reply within 1 day
-
Iceberg tenant table listing ignores pageSize and pageTokenPossibly taken @ferhatelmas claimed this 7 days ago. Open
Difficulty 4/5 1-2 days Newbie friendliness 35/100
supabase/storage#1549 · 1 assignee ·
Maintainers usually reply within 1 day
-
S3 PutObject drops the Expires system metadataPossibly taken @ferhatelmas claimed this 7 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
supabase/storage#1548 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in supabase/storage
Similar issues
-
area: server priority: P3 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
appandflow/stim#4538 ·
Maintainers usually reply within 1 day
-
[BUG] Published Docker images lack the redis extra: HEADROOM_COMPRESS_SESSION_STORE stops startupPossibly taken @AlessandroSpallina claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
headroomlabs-ai/headroom#4513 ·
Maintainers usually reply within 1 day
-
bug extension extension: obsidian platform: Windows
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
raycast/extensions#32838 · 1 comment ·
Maintainers usually reply within 1 day
-
copy design-review mac P3
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
tosunlab/hisarapp-core#510 ·
-
bug priority-medium to-agent
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day