supabase / storage / 41877716993

88%

push

github

fix: require SignedHeaders coverage for S3 route-selector and copy headers (#1662)

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

S3 SigV4 requests are only validated against the headers listed in
`SignedHeaders` a header present on the request but not in that list is
never checked.

## What is the new behavior?

Any header that selects the S3 operation, or that
CopyObject/UploadPartCopy reads to decide its behavior, must now be part
of `SignedHeaders` if present on the request otherwise the request is
rejected with `403 AccessDenied`.

8350 of 10081 branches covered (82.83%)

Branch coverage included in aggregate %.

72 of 72 new or added lines in 12 files covered. (100.0%)

14262 of 15838 relevant lines covered (90.05%)

1256.68 hits per line