ITADN

Fix ranged GET signing failure with Cloudflare R2

#452Pull Requestw4nderlust 创建于 2026-04-06
W
w4nderlustcommented
## Problem `get_object_range` (ranged GET) requests fail with `SignatureDoesNotMatch` on Cloudflare R2. The `headers()` method in `request_trait.rs` had a skip-list of commands that should not include `content-length` and `content-type` headers. `GetObjectRange` was missing from this list, so it fell through to the catch-all `_ =>` arm that adds `content-length: 0` and `content-type: text/plain`. These empty/meaningless headers get included in the AWS4-HMAC-SHA256 canonical request. AWS S3 happens to tolerate this, but Cloudflare R2 rejects the signature because the canonical request doesn't match what R2 computes server-side. The same class of bug also affected other body-less commands routed through PUT/POST/DELETE (`DeleteObject`, `AbortMultipartUpload`, `InitiateMultipartUpload`, etc.). ## Fix Added a `has_body()` helper on `Command` that returns `true` only for commands that actually serialize request content (`PutObject`, `UploadPart`, `CompleteMultipartUpload`, `CreateBucket`, `PutBucketLifecycle`, `PutBucketCors`, `PutObjectTagging`). The header insertion now checks `has_body()` instead of using a skip-list or matching on the HTTP verb. This prevents the same bug from happening if new body-less commands are added in the future. ## Testing All existing tests pass. Verified the fix against a real Cloudflare R2 bucket: ranged GET downloads that were failing with `SignatureDoesNotMatch` now succeed. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/durch/rust-s3/452) <!-- Reviewable:end --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Request header logic updated so copy-source is handled separately and content headers are only added for requests that carry a body. * **Behavior** * Broadened recognition of which S3 operations include a request body (uploads, multipart flows, bucket creation and certain bucket settings), reducing signature mismatches for ranged/other body-less requests. * **Tests** * Added tests validating body-detection and signing/header behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
合并状态:未合并 8 条评论