aws-sdk-core 2.11.549

data/lib/aws-sdk-core/plugins/s3_redirects.rb

@@ -0,0 +1,37 @@
+module Aws
+  module Plugins
+
+    # @seahorse.client.option [Boolean] :follow_redirects (true)
+    #   When `true`, this client will follow 307 redirects returned
+    #   by Amazon S3.
+    class S3Redirects < Seahorse::Client::Plugin
+
+      option(:follow_redirects, true)
+
+      # @api private
+      class Handler < Seahorse::Client::Handler
+
+        def call(context)
+          response = @handler.call(context)
+          if context.http_response.status_code == 307
+            endpoint = context.http_response.headers['location']
+            context.http_request.endpoint = endpoint
+            context.http_response.body.truncate(0)
+            @handler.call(context)
+          else
+            response
+          end
+        end
+
+      end
+
+      def add_handlers(handlers, config)
+        if config.follow_redirects
+          # we want to re-trigger request signing
+          handlers.add(Handler, step: :sign, priority: 90)
+        end
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/s3_request_signer.rb

@@ -0,0 +1,166 @@
+require 'set'
+
+module Aws
+  module Plugins
+    # This plugin is an implementation detail and may be modified.
+    # @api private
+    class S3RequestSigner < Seahorse::Client::Plugin
+
+      option(:signature_version, 'v4')
+
+      class SigningHandler < RequestSigner::Handler
+
+        def call(context)
+          require_credentials(context)
+          version = context.config.signature_version
+          case version
+          when 'v4' then apply_v4_signature(context)
+          when 's3' then apply_s3_legacy_signature(context)
+          else
+            raise "unsupported signature version #{version.inspect}, valid"\
+              " options: 'v4' (default), 's3'"
+          end
+          @handler.call(context)
+        end
+
+        private
+
+        def apply_v4_signature(context)
+          Signers::V4.new(
+            context.config.credentials, 's3',
+            context[:cached_sigv4_region] || context.config.sigv4_region,
+          ).sign(context.http_request)
+        end
+
+        def apply_s3_legacy_signature(context)
+          Signers::S3.sign(context)
+        end
+
+      end
+
+      # Abstract base class for the other two handlers
+      class Handler < Seahorse::Client::Handler
+
+        private
+
+        def new_hostname(context, region)
+          bucket = context.params[:bucket]
+          if region == 'us-east-1'
+            "#{bucket}.s3.amazonaws.com"
+          else
+            bucket + '.' + URI.parse(EndpointProvider.resolve(region, 's3')).host
+          end
+        end
+
+      end
+
+      # This handler will update the http endpoint when the bucket region
+      # is known/cached.
+      class CachedBucketRegionHandler < Handler
+
+        def call(context)
+          if bucket = context.params[:bucket]
+            use_regional_endpoint_when_known(context, bucket)
+          end
+          @handler.call(context)
+        end
+
+        private
+
+        def use_regional_endpoint_when_known(context, bucket)
+          cached_region = S3::BUCKET_REGIONS[bucket]
+          if cached_region && cached_region != context.config.region
+            context.http_request.endpoint.host = new_hostname(context, cached_region)
+            context[:cached_sigv4_region] = cached_region
+            context[:cached_signature_version] = :v4
+          end
+        end
+
+      end
+
+      # This handler detects when a request fails because of a mismatched bucket
+      # region. It follows up by making a request to determine the correct
+      # region, then finally a version 4 signed request against the correct
+      # regional endpoint.
+      class BucketRegionErrorHandler < Handler
+
+        def call(context)
+          response = @handler.call(context)
+          handle_region_errors(response)
+        end
+
+        private
+
+        def handle_region_errors(response)
+          if wrong_sigv4_region?(response)
+            get_region_and_retry(response.context)
+          else
+            response
+          end
+        end
+
+        def get_region_and_retry(context)
+          actual_region = context.http_response.headers['x-amz-bucket-region']
+          actual_region ||= region_from_body(context.http_response.body_contents)
+          update_bucket_cache(context, actual_region)
+          log_warning(context, actual_region)
+          update_region_header(context, actual_region)
+          @handler.call(context)
+        end
+
+        def update_bucket_cache(context, actual_region)
+          S3::BUCKET_REGIONS[context.params[:bucket]] = actual_region
+        end
+
+        def wrong_sigv4_region?(resp)
+          resp.context.http_response.status_code == 400 &&
+          (
+            resp.context.http_response.headers['x-amz-bucket-region'] ||
+            resp.context.http_response.body_contents.match(/<Region>.+?<\/Region>/)
+          )
+        end
+
+        def update_region_header(context, region)
+          context.http_response.body.truncate(0)
+          context.http_request.headers.delete('authorization')
+          context.http_request.headers.delete('x-amz-security-token')
+          context.http_request.endpoint.host = new_hostname(context, region)
+          signer = Signers::V4.new(context.config.credentials, 's3', region)
+          signer.sign(context.http_request)
+        end
+
+        def region_from_body(body)
+          region = body.match(/<Region>(.+?)<\/Region>/)[1]
+          if region.nil? || region == ""
+            raise "couldn't get region from body: #{body}"
+          else
+            region
+          end
+        end
+
+        def log_warning(context, actual_region)
+          msg = "S3 client configured for #{context.config.region.inspect} " +
+            "but the bucket #{context.params[:bucket].inspect} is in " +
+            "#{actual_region.inspect}; Please configure the proper region " +
+            "to avoid multiple unnecessary redirects and signing attempts\n"
+          if logger = context.config.logger
+            logger.warn(msg)
+          else
+            warn(msg)
+          end
+        end
+
+      end
+
+      # BEFORE signing
+      handle(CachedBucketRegionHandler, step: :sign, priority: 60)
+
+      # sign the request
+      handler(SigningHandler, step: :sign)
+
+      # AFTER signing
+      handle(BucketRegionErrorHandler, step: :sign, priority: 40)
+
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/s3_sse_cpk.rb

@@ -0,0 +1,64 @@
+require 'uri'
+require 'openssl'
+
+module Aws
+  module Plugins
+
+    # @seahorse.client.option [Boolean] :require_https_for_sse_cpk (true)
+    #   When `true`, the endpoint **must** be HTTPS for all operations
+    #   where server-side-encryption is used with customer-provided keys.
+    #   This should only be disabled for local testing.
+    class S3SseCpk < Seahorse::Client::Plugin
+
+      option(:require_https_for_sse_cpk, true)
+
+      class Handler < Seahorse::Client::Handler
+
+        def call(context)
+          compute_key_md5(context)
+          @handler.call(context)
+        end
+
+        private
+
+        def compute_key_md5(context)
+          params = context.params
+          if key = params[:sse_customer_key]
+            require_https(context)
+            params[:sse_customer_key] = base64(key)
+            params[:sse_customer_key_md5] = base64(md5(key))
+          end
+          if key = params[:copy_source_sse_customer_key]
+            require_https(context)
+            params[:copy_source_sse_customer_key] = base64(key)
+            params[:copy_source_sse_customer_key_md5] = base64(md5(key))
+          end
+        end
+
+        def require_https(context)
+          unless URI::HTTPS === context.config.endpoint
+            msg = <<-MSG.strip.gsub("\n", ' ')
+              Attempting to send customer-provided-keys for S3
+              server-side-encryption over HTTP; Please configure a HTTPS
+              endpoint. If you are attempting to use a test endpoint,
+              you can disable this check via `:require_https_for_sse_cpk`
+            MSG
+            raise ArgumentError, msg
+          end
+        end
+
+        def md5(str)
+          OpenSSL::Digest::MD5.digest(str)
+        end
+
+        def base64(str)
+          Base64.encode64(str).strip
+        end
+
+      end
+
+      handler(Handler, step: :initialize)
+
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/s3_url_encoded_keys.rb

@@ -0,0 +1,93 @@
+require 'uri'
+require 'cgi'
+
+module Aws
+  module Plugins
+
+    # This plugin auto-populates the `:encoding_type` request parameter
+    # to all calls made to Amazon S3 that accept it.
+    #
+    # This enables Amazon S3 to return object keys that might contain
+    # invalid XML characters as URL encoded strings.  This plugin also
+    # automatically decodes these keys so that the key management is
+    # transparent to the user.
+    #
+    # If you specify the `:encoding_type` parameter, then this plugin
+    # will be disabled, and you will need to decode the keys yourself.
+    #
+    # The following operations are managed:
+    #
+    # * {S3::Client#list_objects}
+    # * {S3::Client#list_multipart_uploads}
+    # * {S3::Client#list_object_versions}
+    #
+    class S3UrlEncodedKeys < Seahorse::Client::Plugin
+
+      class Handler < Seahorse::Client::Handler
+
+        def call(context)
+          if context.params.key?(:encoding_type)
+            @handler.call(context) # user managed
+          else
+            manage_keys(context)
+          end
+        end
+
+        private
+
+        def manage_keys(context)
+          context.params[:encoding_type] = 'url'
+          @handler.call(context).on_success do |resp|
+            send("decode_#{resp.context.operation_name}_keys", resp.data)
+          end
+        end
+
+        def decode_list_objects_keys(data)
+          decode(:marker, data)
+          decode(:next_marker, data)
+          decode(:prefix, data)
+          decode(:delimiter, data)
+          data.contents.each { |o| decode(:key, o) } if data.contents
+          data.common_prefixes.each { |o| decode(:prefix, o) } if data.common_prefixes
+        end
+
+        def decode_list_object_versions_keys(data)
+          decode(:key_marker, data)
+          decode(:next_key_marker, data)
+          decode(:prefix, data)
+          decode(:delimiter, data)
+          data.versions.each { |o| decode(:key, o) } if data.versions
+          data.delete_markers.each { |o| decode(:key, o) } if data.delete_markers
+          data.common_prefixes.each { |o| decode(:prefix, o) } if data.common_prefixes
+        end
+
+        def decode_list_multipart_uploads_keys(data)
+          decode(:key_marker, data)
+          decode(:next_key_marker, data)
+          decode(:prefix, data)
+          decode(:delimiter, data)
+          data.uploads.each { |o| decode(:key, o) } if data.uploads
+          data.common_prefixes.each { |o| decode(:prefix, o) } if data.common_prefixes
+        end
+
+        def decode(member, struct)
+          if struct[member]
+            struct[member] = CGI.unescape(struct[member])
+          end
+        end
+
+      end
+
+      handler(Handler,
+        step: :validate,
+        priority: 0,
+        operations: [
+          :list_objects,
+          :list_object_versions,
+          :list_multipart_uploads,
+        ]
+      )
+
+    end
+  end
+end

data/lib/aws-sdk-core/plugins/sqs_md5s.rb

@@ -0,0 +1,164 @@
+require 'openssl'
+
+module Aws
+  module Plugins
+
+    # @seahorse.client.option [Boolean] :verify_checksums (true)
+    #   When `true` MD5 checksums will be computed for messages sent to
+    #   an SQS queue and matched against MD5 checksums returned by Amazon SQS.
+    #   `Aws::Errors::Checksum` errors are raised for cases where checksums do
+    #   not match.
+    class SQSMd5s < Seahorse::Client::Plugin
+      OPERATIONS_TO_VERIFY = [:send_message, :send_message_batch]
+
+      # @api private
+      class Handler < Seahorse::Client::Handler
+        def call(context)
+          @handler.call(context).on_success do |response|
+            case context.operation_name
+            when :send_message
+              validate_send_message(context, response)
+            when :send_message_batch
+              validate_send_message_batch(context, response)
+            end
+          end
+        end
+
+        private
+
+        TRANSPORT_TYPE_ENCODINGS = {
+          'String' => 1,
+          'Binary' => 2,
+          'Number' => 1
+        }
+
+        DATA_TYPE = /\A(String|Binary|Number)(\..+)?\z/
+
+        NORMALIZED_ENCODING = Encoding::UTF_8
+
+        def validate_send_message(context, response)
+          body = context.params[:message_body]
+          attributes = context.params[:message_attributes]
+          validate_single_message(body, attributes, response)
+        end
+
+        def validate_send_message_batch(context, response)
+          context.params[:entries].each do |entry|
+            id = entry[:id]
+            body = entry[:message_body]
+            attributes = entry[:message_attributes]
+            message_response = response.successful.select { |r| r.id == id }[0]
+            unless message_response.nil?
+              validate_single_message(body, attributes, message_response)
+            end
+          end
+        end
+
+        def validate_single_message(body, attributes, response)
+          validate_body(body, response)
+          unless attributes.nil? || attributes.empty?
+            validate_attributes(attributes, response)
+          end
+        end
+
+        def validate_body(body, response)
+          calculated_md5 = md5_of_message_body(body)
+          returned_md5 = response.md5_of_message_body
+          if calculated_md5 != returned_md5
+            error_message =  mismatch_error_message(
+              'message body',
+              calculated_md5,
+              returned_md5,
+              response)
+            raise Aws::Errors::ChecksumError, error_message
+          end
+        end
+
+        def validate_attributes(attributes, response)
+          calculated_md5 = md5_of_message_attributes(attributes)
+          returned_md5 = response.md5_of_message_attributes
+          if returned_md5 != calculated_md5
+            error_message =  mismatch_error_message(
+              'message attributes',
+              calculated_md5,
+              returned_md5,
+              response)
+            raise Aws::Errors::ChecksumError, error_message
+          end
+        end
+
+        def md5_of_message_body(message_body)
+          OpenSSL::Digest::MD5.hexdigest(message_body)
+        end
+
+        def md5_of_message_attributes(message_attributes)
+          encoded = { }
+          message_attributes.each do |name, attribute|
+            name = name.to_s
+            encoded[name] = String.new
+            data_type_without_label = DATA_TYPE.match(attribute[:data_type])[1]
+            encoded[name] << encode_length_and_bytes(name) <<
+            encode_length_and_bytes(attribute[:data_type]) <<
+            [TRANSPORT_TYPE_ENCODINGS[data_type_without_label]].pack('C'.freeze)
+
+            if attribute[:string_value] != nil
+              encoded[name] << encode_length_and_string(attribute[:string_value])
+            elsif attribute[:binary_value] != nil
+              encoded[name] << encode_length_and_bytes(attribute[:binary_value])
+            end
+          end
+
+          buffer = encoded.keys.sort.reduce(String.new) do |string, name|
+            string << encoded[name]
+          end
+          OpenSSL::Digest::MD5.hexdigest(buffer)
+        end
+
+        def encode_length_and_string(string)
+          string = String.new(string)
+          string.encode!(NORMALIZED_ENCODING)
+          encode_length_and_bytes(string)
+        end
+
+        def encode_length_and_bytes(bytes)
+          [bytes.bytesize, bytes].pack('L>a*'.freeze)
+        end
+
+        def mismatch_error_message(section, local_md5, returned_md5, response)
+          m = "MD5 returned by SQS does not match " <<
+          "the calculation on the original request. ("
+
+          if response.respond_to?(:id) && !response.id.nil?
+            m << "Message ID: #{response.id}, "
+          end
+
+          m << "MD5 calculated by the #{section}: " <<
+          "'#{local_md5}', MD5 checksum returned: '#{returned_md5}')"
+        end
+      end
+
+      option(:verify_checksums) do |config|
+        # By default, we will disable checksum verification when response
+        # stubbing is enable. If a user decides to enable both features,
+        # then they will need to stub the MD5s in the response.
+        # See the spec/aws/sqs/client/verify_checksums_spec.rb for
+        # examples of how to do this.
+        if config.respond_to?(:stub_responses)
+          !config.stub_responses
+        else
+          config.verify_checksums
+        end
+      end
+
+      def add_handlers(handlers, config)
+        if config.verify_checksums
+          handlers.add(Handler, {
+            priority: 10 ,
+            step: :validate,
+            operations: SQSMd5s::OPERATIONS_TO_VERIFY
+          })
+        end
+      end
+    end
+  end
+end