@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/storage-presigned-url.test.js

@@ -745,7 +745,151 @@ async function testAuditEventEmitted() {
   }
 }
 
+// SigV4 requires the space character to be percent-encoded as "%20" in the
+// canonical (signed) query string — never as "+" (AWS: "encode the space
+// character as %20 and not +"). The WHATWG URL serializes its query via
+// form-urlencoding (space → "+"), so a signed query parameter carrying a
+// literal space — a response-content-disposition filename, a list prefix — was
+// transmitted as "+" while the signature committed to "%20": every
+// S3-compatible server re-canonicalizes to different bytes and answers
+// SignatureDoesNotMatch. The pre-existing coverage asserted only
+// searchParams.get(...) (which decodes "+" and "%20" alike), masking the wire
+// divergence. These drive the wire bytes + a full server-side re-verification.
+function _sigv4ServerReSign(o) {
+  // Rebuild the canonical query from the RAW wire query string (not
+  // url.searchParams — that would re-encode and hide a client bug), decoding
+  // per RFC 3986 where "+" is a literal plus (never a space — the documented
+  // S3 SigV4 rule), then re-derive the signature the way an S3 server does.
+  var wire = o.url.search.replace(/^\?/, "");
+  var pairs = (wire.length === 0 ? [] : wire.split("&")).map(function (kv) {
+    var i = kv.indexOf("=");
+    return i === -1 ? [kv, ""] : [kv.slice(0, i), kv.slice(i + 1)];
+  }).filter(function (p) { return p[0] !== o.signatureParam; });
+  function dec(t) { try { return decodeURIComponent(t); } catch (_e) { return t; } }
+  var canonQuery = pairs.map(function (p) {
+    return sigv4Internal.awsUriEncode(dec(p[0]), true) + "=" +
+           sigv4Internal.awsUriEncode(dec(p[1]), true);
+  }).sort().join("&");
+  var hdrKeys = Object.keys(o.signedHeaders).sort();
+  var canonHeaders = hdrKeys.map(function (k) { return k + ":" + o.signedHeaders[k] + "\n"; }).join("");
+  var canonReq = [o.method, o.url.pathname, canonQuery, canonHeaders,
+                  hdrKeys.join(";"), o.payloadHash].join("\n");
+  var dateStamp = o.amzDate.slice(0, 8);
+  var scope = dateStamp + "/" + o.region + "/" + o.service + "/aws4_request";
+  var sts = ["AWS4-HMAC-SHA256", o.amzDate, scope, sigv4Internal.sha256Hex(canonReq)].join("\n");
+  var key = sigv4Internal.deriveSigningKey(o.secretAccessKey, dateStamp, o.region, o.service);
+  return nodeCrypto.createHmac("sha256", key).update(sts).digest("hex");
+}
+
+async function testSigv4PresignSpaceEncodedAsPercent20() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-presign-"));
+  try {
+    await setupTestDb(tmpDir);
+    b.storage._resetForTest();
+    await b.vault.init({ dataDir: tmpDir, mode: "plaintext" });
+    b.storage.init({
+      backends: { "s3": SIGV4_CONFIG },
+      defaultClassification: "operational",
+    });
+
+    var fixed = new Date("2026-04-27T12:34:56Z");
+    var dl = b.storage.presignedDownloadUrl("invoices/A-42.pdf", {
+      classification: "operational",
+      expiresIn:      300,
+      date:           fixed,
+      responseHeaders: { contentDisposition: 'attachment; filename="my report.pdf"' },
+    });
+    var url = new URL(dl.url);
+    var wire = url.search;
+
+    // Model-free: the space MUST be "%20" on the wire, never a bare "+".
+    check("presign: space in signed query param encoded as %20",
+      /response-content-disposition=[^&]*%20/.test(wire));
+    check("presign: no bare '+' (form-encoded space) in signed query",
+      wire.indexOf("+") === -1);
+
+    // Full server-side re-verification: the transmitted URL must validate.
+    var serverSig = _sigv4ServerReSign({
+      url:             url,
+      method:          "GET",
+      signedHeaders:   { host: url.host },
+      payloadHash:     "UNSIGNED-PAYLOAD",
+      signatureParam:  "X-Amz-Signature",
+      amzDate:         url.searchParams.get("X-Amz-Date"),
+      region:          SIGV4_CONFIG.region,
+      service:         "s3",
+      secretAccessKey: SIGV4_CONFIG.secretAccessKey,
+    });
+    check("presign: transmitted URL validates server-side (no SignatureDoesNotMatch)",
+      serverSig === url.searchParams.get("X-Amz-Signature"));
+  } finally {
+    b.storage._resetForTest();
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testSigv4HeaderAuthQuerySpaceAligned() {
+  // list(prefix="My Documents/") and any signed-query object op funnel through
+  // signRequest; the URL it signs is the URL the caller transmits, so its wire
+  // query must match the canonical query it signed (space → "%20", not "+").
+  var url = new URL("https://blamejs-test.s3.us-east-1.amazonaws.com/");
+  url.searchParams.set("list-type", "2");
+  url.searchParams.set("prefix", "My Documents/report v2.pdf");
+  var signed = sigv4Internal.signRequest({
+    method:          "GET",
+    url:             url,
+    headers:         {},
+    payloadHash:     sigv4Internal.sha256Hex(Buffer.alloc(0)),
+    region:          SIGV4_CONFIG.region,
+    accessKeyId:     SIGV4_CONFIG.accessKeyId,
+    secretAccessKey: SIGV4_CONFIG.secretAccessKey,
+  });
+
+  check("header-auth: signRequest leaves wire query space as %20",
+    /prefix=My%20Documents%2Freport%20v2\.pdf/.test(url.search));
+  check("header-auth: no bare '+' left on the wire query",
+    url.search.indexOf("+") === -1);
+
+  // The 3rd line of the signed canonical request is the canonical query the
+  // signature commits to. Re-deriving it from the WIRE (RFC-3986 decode: "+"
+  // literal) must reproduce it exactly, or the server rejects.
+  var signedCanonQueryLine = signed.canonicalRequest.split("\n")[2];
+  function dec(t) { try { return decodeURIComponent(t); } catch (_e) { return t; } }
+  var wireCanonQuery = url.search.replace(/^\?/, "").split("&").map(function (kv) {
+    var i = kv.indexOf("=");
+    var k = i === -1 ? kv : kv.slice(0, i);
+    var v = i === -1 ? "" : kv.slice(i + 1);
+    return sigv4Internal.awsUriEncode(dec(k), true) + "=" + sigv4Internal.awsUriEncode(dec(v), true);
+  }).sort().join("&");
+  check("header-auth: wire query re-derives to the signed canonical query",
+    wireCanonQuery === signedCanonQueryLine);
+}
+
+// The shared wire/canonical query-alignment helper both the SigV4 signer and
+// the GCS V4 presigner compose after their final searchParams mutation: it
+// rewrites a bare "+" (URLSearchParams' encoding of a space) to "%20" so the
+// transmitted query is byte-identical to the signed canonical query, while
+// leaving a literal "+" (serialized as %2B) and bare subresource tokens alone.
+function testAlignWireQueryToSigV4Helper() {
+  var u = new URL("https://h/k?X-Amz-SignedHeaders=host&resp=my+file.pdf&X-Amz-Signature=abc");
+  sigv4Internal.alignWireQueryToSigV4(u);
+  check("alignWireQuery: a bare + (encoded space) becomes %20 on the wire",
+        u.search.indexOf("+") === -1 && u.search.indexOf("my%20file.pdf") !== -1);
+
+  var u2 = new URL("https://h/k");
+  u2.searchParams.set("v", "a+b");   // a literal + serializes as %2B
+  sigv4Internal.alignWireQueryToSigV4(u2);
+  check("alignWireQuery: a literal + (%2B) is preserved, not corrupted",
+        u2.search.indexOf("a%2Bb") !== -1);
+
+  var u3 = new URL("https://h/k?uploads");
+  sigv4Internal.alignWireQueryToSigV4(u3);
+  check("alignWireQuery: a bare subresource token passes through unchanged",
+        u3.search === "?uploads");
+}
+
 async function run() {
+  await testAlignWireQueryToSigV4Helper();
   await testSurface();
   await testSigv4ProducesPresignedUrl();
   await testSigv4SignatureIsDeterministic();
@@ -755,6 +899,8 @@ async function run() {
   await testSigv4ContentTypeIsSigned();
   await testSigv4PresignedDownloadUrl();
   await testSigv4ResponseHeaderOverrides();
+  await testSigv4PresignSpaceEncodedAsPercent20();
+  await testSigv4HeaderAuthQuerySpaceAligned();
   await testGcsV4Presigning();
   await testAzureSasPresigning();
   await testPresignedUploadPolicyMaxBytesRequired();