From f9a70da28b0273ce74a73b58dda33046beab8420 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 7 Oct 2026 05:10:11 -0700 Subject: [PATCH] s3: return InvalidArgument for malformed x-amz-content-sha256 A header value that decodes to neither 32-byte hex nor base64 is a malformed argument, not a hash mismatch. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- weed/s3api/s3api_put_object_helper.go | 2 +- weed/s3api/s3api_put_object_helper_test.go | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/weed/s3api/s3api_put_object_helper.go b/weed/s3api/s3api_put_object_helper.go index cc0d7b1c72..12a861ddf3 100644 --- a/weed/s3api/s3api_put_object_helper.go +++ b/weed/s3api/s3api_put_object_helper.go @@ -42,7 +42,7 @@ func getRequestDataReader(s3a *S3ApiServer, r *http.Request) (io.ReadCloser, s3e expected, valid := expectedContentSha256(r) if !valid { - return nil, s3err.ErrContentSHA256Mismatch + return nil, s3err.ErrInvalidArgument } if expected != nil && dataReader != nil { if r.ContentLength == 0 { diff --git a/weed/s3api/s3api_put_object_helper_test.go b/weed/s3api/s3api_put_object_helper_test.go index 355a5984c1..9328bb3db3 100644 --- a/weed/s3api/s3api_put_object_helper_test.go +++ b/weed/s3api/s3api_put_object_helper_test.go @@ -299,6 +299,12 @@ func TestGetRequestDataReaderEmptyBodyHash(t *testing.T) { t.Fatalf("empty body with wrong hash: code=%v", code) } + malformed := httptest.NewRequest("PUT", "/b/o", strings.NewReader("x")) + malformed.Header.Set("X-Amz-Content-Sha256", "nothex") + if _, code := getRequestDataReader(s3a, malformed); code != s3err.ErrInvalidArgument { + t.Fatalf("malformed sha256 header: code=%v", code) + } + emptySum := sha256.Sum256(nil) match := httptest.NewRequest("PUT", "/b/dir/", http.NoBody) match.Header.Set("X-Amz-Content-Sha256", hex.EncodeToString(emptySum[:]))