aws-sdk-s3 1.169.0 → 1.190.0

data/lib/aws-sdk-s3/plugins/checksum_algorithm.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Aws
+  module S3
+    module Plugins
+      # @api private
+      class ChecksumAlgorithm < Seahorse::Client::Plugin
+
+        # S3 GetObject results for whole Multipart Objects contain a checksum
+        # that cannot be validated. These should be skipped by the
+        # ChecksumAlgorithm plugin.
+        class SkipWholeMultipartGetChecksumsHandler < Seahorse::Client::Handler
+          def call(context)
+            context[:http_checksum] ||= {}
+            context[:http_checksum][:skip_on_suffix] = true
+
+            @handler.call(context)
+          end
+        end
+
+        def add_handlers(handlers, _config)
+          handlers.add(
+            SkipWholeMultipartGetChecksumsHandler,
+            step: :initialize,
+            operations: [:get_object]
+          )
+        end
+      end
+    end
+  end
+end

data/lib/aws-sdk-s3/plugins/express_session_auth.rb

@@ -29,24 +29,17 @@ for different buckets.
         # @api private
         class Handler < Seahorse::Client::Handler
           def call(context)
-            if (props = context[:endpoint_properties])
-              # S3 Express endpoint - turn off md5 and enable crc32 default
-              if props['backend'] == 'S3Express'
-                if context.operation_name == :put_object || checksum_required?(context)
-                  context[:default_request_checksum_algorithm] = 'CRC32'
-                end
-                context[:s3_express_endpoint] = true
-              end
+            context[:s3_express_endpoint] = true if s3_express_endpoint?(context)
 
-              # if s3 express auth, use new credentials and sign additional header
-              if context[:auth_scheme]['name'] == 'sigv4-s3express' &&
-                 !context.config.disable_s3_express_session_auth
-                bucket = context.params[:bucket]
-                credentials_provider = context.config.express_credentials_provider
-                credentials = credentials_provider.express_credentials_for(bucket)
-                context[:sigv4_credentials] = credentials # Sign will use this
-              end
+            # if s3 express auth, use new credentials and sign additional header
+            if context[:auth_scheme]['name'] == 'sigv4-s3express' &&
+               !context.config.disable_s3_express_session_auth
+              bucket = context.params[:bucket]
+              credentials_provider = context.config.express_credentials_provider
+              credentials = credentials_provider.express_credentials_for(bucket)
+              context[:sigv4_credentials] = credentials # Sign will use this
             end
+
             with_metric(credentials) { @handler.call(context) }
           end
 
@@ -58,10 +51,8 @@ for different buckets.
             Aws::Plugins::UserAgent.metric('S3_EXPRESS_BUCKET', &block)
           end
 
-          def checksum_required?(context)
-            context.operation.http_checksum_required ||
-              (context.operation.http_checksum &&
-                context.operation.http_checksum['requestChecksumRequired'])
+          def s3_express_endpoint?(context)
+            context[:endpoint_properties]['backend'] == 'S3Express'
           end
         end
 

data/lib/aws-sdk-s3/plugins/http_200_errors.rb

@@ -71,9 +71,9 @@ module Aws
 
           def check_for_error(context)
             xml = context.http_response.body_contents
-            if xml.match(/\?>\s*<Error>/)
-              error_code = xml.match(/<Code>(.+?)<\/Code>/)[1]
-              error_message = xml.match(/<Message>(.+?)<\/Message>/)[1]
+            if xml.match(/<\?xml\s[^>]*\?>\s*<Error>/)
+              error_code = xml.match(%r{<Code>(.+?)</Code>})[1]
+              error_message = xml.match(%r{<Message>(.+?)</Message>})[1]
               S3::Errors.error_class(error_code).new(context, error_message)
             elsif incomplete_xml_body?(xml, context.operation.output)
               Seahorse::Client::NetworkingError.new(

data/lib/aws-sdk-s3/plugins/md5s.rb

@@ -6,81 +6,20 @@ module Aws
   module S3
     module Plugins
       # @api private
-      # This plugin is effectively deprecated in favor of modeled
+      # This plugin is deprecated in favor of modeled
       # httpChecksumRequired traits.
       class Md5s < Seahorse::Client::Plugin
-        # These operations allow Content MD5 but are not required by
-        # httpChecksumRequired. This list should not grow.
-        OPTIONAL_OPERATIONS = [
-          :put_object,
-          :upload_part
-        ]
-
-        # @api private
-        class Handler < Seahorse::Client::Handler
-
-          CHUNK_SIZE = 1 * 1024 * 1024 # one MB
-
-          def call(context)
-            if !context[:checksum_algorithms] && # skip in favor of flexible checksum
-               !context[:s3_express_endpoint] # s3 express endpoints do not support md5
-              body = context.http_request.body
-              if body.respond_to?(:size) && body.size > 0
-                context.http_request.headers['Content-Md5'] ||= md5(body)
-              end
-            end
-            @handler.call(context)
-          end
-
-          private
-
-          # @param [File, Tempfile, IO#read, String] value
-          # @return [String<MD5>]
-          def md5(value)
-            if (File === value || Tempfile === value) && !value.path.nil? && File.exist?(value.path)
-              OpenSSL::Digest::MD5.file(value).base64digest
-            elsif value.respond_to?(:read)
-              md5 = OpenSSL::Digest::MD5.new
-              update_in_chunks(md5, value)
-              md5.base64digest
-            else
-              OpenSSL::Digest::MD5.digest(value).base64digest
-            end
-          end
-
-          def update_in_chunks(digest, io)
-            loop do
-              chunk = io.read(CHUNK_SIZE)
-              break unless chunk
-              digest.update(chunk)
-            end
-            io.rewind
-          end
-
-        end
-
         option(:compute_checksums,
-          default: true,
-          doc_type: 'Boolean',
-          docstring: <<-DOCS)
-When `true` a MD5 checksum will be computed and sent in the Content Md5
-header for :put_object and :upload_part. When `false`, MD5 checksums
-will not be computed for these operations. Checksums are still computed
-for operations requiring them. Checksum errors returned by Amazon S3 are
-automatically retried up to `:retry_limit` times.
-          DOCS
-
-        def add_handlers(handlers, config)
-          if config.compute_checksums
-            # priority set low to ensure md5 is computed AFTER the request is
-            # built but before it is signed
-            handlers.add(
-              Handler,
-              priority: 10, step: :build, operations: OPTIONAL_OPERATIONS
-            )
-          end
+               default: true,
+               doc_type: 'Boolean',
+               docstring: <<~DOCS)
+                 This option is deprecated. Please use `:request_checksum_calculation` instead.
+                 When `false`, `request_checksum_calculation` is overridden to `when_required`.
+               DOCS
+
+        def after_initialize(client)
+          client.config.request_checksum_calculation = 'when_required' unless client.config.compute_checksums
         end
-
       end
     end
   end

data/lib/aws-sdk-s3/plugins/streaming_retry.rb

@@ -62,18 +62,16 @@ module Aws
         class Handler < Seahorse::Client::Handler
 
           def call(context)
-            target = context.params[:response_target] || context[:response_target]
-
             # retry is only supported when range is NOT set on the initial request
-            if supported_target?(target) && !context.params[:range]
-              add_event_listeners(context, target)
+            if supported_target?(context) && !context.params[:range]
+              add_event_listeners(context)
             end
             @handler.call(context)
           end
 
           private
 
-          def add_event_listeners(context, target)
+          def add_event_listeners(context)
             context.http_response.on_headers(200..299) do
               case context.http_response.body
               when Seahorse::Client::BlockIO then
@@ -123,8 +121,8 @@ module Aws
               context.http_response.body.is_a?(RetryableManagedFile)
           end
 
-          def supported_target?(target)
-            case target
+          def supported_target?(context)
+            case context[:response_target]
             when Proc, String, Pathname then true
             else false
             end

data/lib/aws-sdk-s3/plugins/url_encoded_keys.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 require 'uri'
-require 'cgi'
+require "cgi/escape"
+require "cgi/util" if RUBY_VERSION < "3.5"
 
 module Aws
   module S3

data/lib/aws-sdk-s3/presigner.rb

@@ -193,15 +193,14 @@ module Aws
         req, expires_in, secure, time, unsigned_headers, hoist = true
       )
         x_amz_headers = {}
-
         http_req = req.context.http_request
-
-        req.handlers.remove(Aws::S3::Plugins::S3Signer::LegacyHandler)
-        req.handlers.remove(Aws::Plugins::Sign::Handler)
         req.handlers.remove(Seahorse::Client::Plugins::ContentLength::Handler)
         req.handlers.remove(Aws::Rest::ContentTypeHandler)
+        req.handlers.remove(Aws::Plugins::ChecksumAlgorithm::OptionHandler)
+        req.handlers.remove(Aws::Plugins::ChecksumAlgorithm::ChecksumHandler)
         req.handlers.remove(Aws::Plugins::InvocationId::Handler)
-
+        req.handlers.remove(Aws::Plugins::Sign::Handler)
+        req.handlers.remove(Aws::S3::Plugins::S3Signer::LegacyHandler)
         req.handle(step: :send) do |context|
           # if an endpoint was not provided, force secure or insecure
           if context.config.regional_endpoint
@@ -238,6 +237,7 @@ module Aws
             credentials_provider: context[:sigv4_credentials] || context.config.credentials,
             signing_algorithm: scheme_name.to_sym,
             uri_escape_path: !!!auth_scheme['disableDoubleEncoding'],
+            normalize_path: !!!auth_scheme['disableNormalizePath'],
             unsigned_headers: unsigned_headers,
             apply_checksum_header: false
           )

data/lib/aws-sdk-s3/resource.rb

@@ -41,13 +41,13 @@ module Aws::S3
     #     acl: "private", # accepts private, public-read, public-read-write, authenticated-read
     #     bucket: "BucketName", # required
     #     create_bucket_configuration: {
-    #       location_constraint: "af-south-1", # accepts af-south-1, ap-east-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-south-2, ap-southeast-1, ap-southeast-2, ap-southeast-3, ca-central-1, cn-north-1, cn-northwest-1, EU, eu-central-1, eu-north-1, eu-south-1, eu-south-2, eu-west-1, eu-west-2, eu-west-3, me-south-1, sa-east-1, us-east-2, us-gov-east-1, us-gov-west-1, us-west-1, us-west-2
+    #       location_constraint: "af-south-1", # accepts af-south-1, ap-east-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-south-2, ap-southeast-1, ap-southeast-2, ap-southeast-3, ap-southeast-4, ap-southeast-5, ca-central-1, cn-north-1, cn-northwest-1, EU, eu-central-1, eu-central-2, eu-north-1, eu-south-1, eu-south-2, eu-west-1, eu-west-2, eu-west-3, il-central-1, me-central-1, me-south-1, sa-east-1, us-east-2, us-gov-east-1, us-gov-west-1, us-west-1, us-west-2
     #       location: {
-    #         type: "AvailabilityZone", # accepts AvailabilityZone
+    #         type: "AvailabilityZone", # accepts AvailabilityZone, LocalZone
     #         name: "LocationNameAsString",
     #       },
     #       bucket: {
-    #         data_redundancy: "SingleAvailabilityZone", # accepts SingleAvailabilityZone
+    #         data_redundancy: "SingleAvailabilityZone", # accepts SingleAvailabilityZone, SingleLocalZone
     #         type: "Directory", # accepts Directory
     #       },
     #     },
@@ -75,13 +75,14 @@ module Aws::S3
     #
     #   <b>Directory buckets </b> - When you use this operation with a
     #   directory bucket, you must use path-style requests in the format
-    #   `https://s3express-control.region_code.amazonaws.com/bucket-name `.
+    #   `https://s3express-control.region-code.amazonaws.com/bucket-name `.
     #   Virtual-hosted-style requests aren't supported. Directory bucket
-    #   names must be unique in the chosen Availability Zone. Bucket names
-    #   must also follow the format ` bucket_base_name--az_id--x-s3` (for
-    #   example, ` DOC-EXAMPLE-BUCKET--usw2-az1--x-s3`). For information about
-    #   bucket naming restrictions, see [Directory bucket naming rules][2] in
-    #   the *Amazon S3 User Guide*
+    #   names must be unique in the chosen Zone (Availability Zone or Local
+    #   Zone). Bucket names must also follow the format `
+    #   bucket-base-name--zone-id--x-s3` (for example, `
+    #   DOC-EXAMPLE-BUCKET--usw2-az1--x-s3`). For information about bucket
+    #   naming restrictions, see [Directory bucket naming rules][2] in the
+    #   *Amazon S3 User Guide*
     #
     #
     #