From df2ace16430fcce4eecb506a73723d81851d6fc5 Mon Sep 17 00:00:00 2001
From: Anthony Lukach <anthonylukach@gmail.com>
Date: Tue, 30 Jun 2026 20:04:55 -0700
Subject: [PATCH] fix(sigv4): use encoded request path for inbound signature
 verification

Uploads of keys containing characters the client percent-escapes (e.g. a
space -> %20) failed with SignatureDoesNotMatch. SigV4's canonical URI is
the percent-encoded path the client signed, but `RequestParts` decodes the
path (correct for bucket/key routing) and we were passing that decoded path
as the `signing_path`. The server then built its canonical request with a
literal space while the client signed `%20`, so the signatures never matched.

Recover the raw encoded path from the request URL via `Uri::path()` (which
does not decode) and use it as the signing path. Routing keeps the decoded
path; outbound signing already re-encodes via `url::Url::parse`, so it was
unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/lib.rs       | 14 +++++++++++++-
 tests/routing.rs | 14 ++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/lib.rs b/src/lib.rs
index 0ce726a..66a1341 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -278,6 +278,18 @@ async fn fetch(req: web_sys::Request, env: Env, ctx: Context) -> Result<web_sys:
         tracing::info_span!("request", %request_id, method = %parts.method, path = %parts.path);
     let _guard = span.enter();
 
+    // SigV4's canonical URI is the percent-encoded path the client signed over.
+    // `RequestParts` decodes the path for bucket/key routing, so recover the raw
+    // encoded path from the request URL for signature verification — otherwise a
+    // key with an escaped character (e.g. a space → `%20`) fails with
+    // SignatureDoesNotMatch. `Uri::path()` returns the path un-decoded; fall back
+    // to the decoded signing path if the URL somehow won't parse.
+    let signing_path = req
+        .url()
+        .parse::<http::Uri>()
+        .map(|u| u.path().to_string())
+        .unwrap_or_else(|_| rewrite.signing_path.clone());
+
     let request_info = RequestInfo::new(
         &parts.method,
         &rewrite.path,
@@ -285,7 +297,7 @@ async fn fetch(req: web_sys::Request, env: Env, ctx: Context) -> Result<web_sys:
         &parts.headers,
         None,
     )
-    .with_signing_path(&rewrite.signing_path)
+    .with_signing_path(&signing_path)
     .with_signing_query(rewrite.signing_query.as_deref());
 
     let start_ms = js_sys::Date::now();
diff --git a/tests/routing.rs b/tests/routing.rs
index fb6a165..209d77e 100644
--- a/tests/routing.rs
+++ b/tests/routing.rs
@@ -135,3 +135,17 @@ fn url_encoded_prefix() {
         Some("list-type=2&prefix=admin%20boundaries/subdir/".to_string())
     );
 }
+
+// ── Signing-path encoding (http::Uri) ───────────────────────────────
+// The proxy recovers the raw, percent-encoded request path from the URL for
+// SigV4 signature verification: `RequestParts` decodes the path for routing,
+// but the client signs the *encoded* path, so a decoded key with a space breaks
+// the signature (SignatureDoesNotMatch). This pins the `http` crate behavior the
+// fix relies on — `Uri::path()` must return the path WITHOUT decoding `%20`.
+#[test]
+fn uri_path_preserves_percent_encoding() {
+    let uri: http::Uri = "https://data.staging.source.coop/acct/prod/foo%20bar?x-id=PutObject"
+        .parse()
+        .unwrap();
+    assert_eq!(uri.path(), "/acct/prod/foo%20bar");
+}