Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not Escape HTML when encode the cloudfront sign policy #2164

Merged
merged 6 commits into from
Oct 2, 2018
Merged

Do not Escape HTML when encode the cloudfront sign policy #2164

merged 6 commits into from
Oct 2, 2018

Conversation

rogchap
Copy link
Contributor

@rogchap rogchap commented Sep 25, 2018

Fixes #2163

jasdel
jasdel suggested changes Sep 25, 2018
View reviewed changes
Copy link
Contributor

@jasdel jasdel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for putting together this change. Could you please add test cases showing this fix correctly creates a signed URL containing & characters.

@rogchap
Copy link
Contributor Author

rogchap commented Sep 26, 2018

@jasdel This should be good to go... the build failed on a go lint error for go1.8... I think if we re-run the build it should pass.

@jasdel
Copy link
Contributor

jasdel commented Sep 26, 2018

Thanks for the update, restarted the build

jasdel
jasdel approved these changes Sep 28, 2018
View reviewed changes
Copy link
Contributor

@jasdel jasdel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the test updates an simplifying the go1.6 encodePolicyJSON.

@jasdel jasdel merged commit 92d5d5f into aws:master Oct 2, 2018
@awstools awstools mentioned this pull request Oct 2, 2018
Merged
xibz pushed a commit to xibz/aws-sdk-go that referenced this pull request Oct 15, 2018
@rogchap @xibz
service/cloudfront/sign: Do not Escape HTML when encode the cloudfron…
d9ffbd4 
…t sign policy (aws#2164)

Fixes the signer escaping HTML elements `<`, `>`, and `&` in the signature policy incorrectly. This specifically fixes the ability to use multiple query parameters in the URL to be signed.

Fix aws#2163
@diehlaws diehlaws added needs-review This issue or pull request needs review from a core team member. and removed review-needed labels Jan 4, 2019
@joshwoodkx joshwoodkx mentioned this pull request Aug 11, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasdel jasdel jasdel approved these changes

Assignees
No one assigned
Labels
needs-review This issue or pull request needs review from a core team member.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@rogchap @jasdel @diehlaws