-
- Notifications
You must be signed in to change notification settings - Fork 88
Open
Description
When using presigned URLs (presignedUrl: true), filenames containing special characters like brackets, spaces, or other URL-sensitive characters are being double-encoded, resulting in malformed URLs that cannot be accessed.
Bug Details
Affected Version: Current version
Component: getFileLocation() method in index.js
Severity: High - Breaks file access for filenames with special characters when using presigned URLs
Problem Description
The issue occurs in the getFileLocation() method where:
- Line 242: The filename is encoded using
filename.split('/').map(encodeURIComponent).join('/') - Line 247: This encoded filename is used to create the S3 key for presigned URL generation
- Line 255: AWS SDK's
getSignedUrl()function internally encodes the key again, causing double encoding
Example
For a filename like doc[123].pdf:
- Expected behavior: Should encode to
doc%5B123%5D.pdfin the presigned URL - Actual behavior: Gets double-encoded to
doc%255B123%255D.pdf- First encoding:
[123]→%5B123%5D - Second encoding by AWS SDK:
%5B123%5D→%255B123%255D
- First encoding:
Root Cause
// Line 242: Pre-encodes the filename const fileName = filename.split('/').map(encodeURIComponent).join('/'); // Line 247: Uses pre-encoded filename for S3 key const fileKey = `${this._bucketPrefix}${fileName}`; // Line 251: AWS SDK encodes the already-encoded key again const params = { Bucket: this._bucket, Key: fileKey }; presignedUrl = await this.getFileSignedUrl(this._s3Client, command, options);Impact
- Presigned URLs become inaccessible for files with special characters
- Affects any filename containing:
[],(), spaces, and other URL-sensitive characters - Works fine for regular S3 URLs (non-presigned) because they don't go through AWS SDK's internal encoding
Steps to Reproduce
- Configure S3 adapter with
presignedUrl: true - Upload a file with special characters in the name (e.g.,
"test [file].pdf") - Generate a presigned URL using
getFileLocation() - Attempt to access the URL - it will return 404/AccessDenied
Metadata
Metadata
Assignees
Labels
No labels