Skip to content

Commit 436d54d

Browse files
Fix SigV4 signing mismatch issue with ?v query parameter (opensearch-project#9730)
* Fix SigV4 signing issue with ?v query parameter Signed-off-by: Zhongnan Su <szhongna@amazon.com> * Changeset file for PR opensearch-project#9730 created/updated --------- Signed-off-by: Zhongnan Su <szhongna@amazon.com> Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
1 parent b2a8d6d commit 436d54d

File tree

3 files changed

+63
-2
lines changed

3 files changed

+63
-2
lines changed

changelogs/fragments/9730.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
fix:
2+
- Fix SigV4 signing mismatch issue with ?v query parameter ([#9730](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/9730))

src/plugins/data_source/server/legacy/http_aws_es/connector.js

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import { Sha256 } from '@aws-crypto/sha256-js';
99
import { AbortController } from '@aws-sdk/abort-controller';
1010
import { defaultProvider } from '@aws-sdk/credential-provider-node';
1111
import { NodeHttpHandler } from '@aws-sdk/node-http-handler';
12-
import queryString from 'query-string';
12+
1313
const HttpConnector = require('elasticsearch/src/lib/connectors/http');
1414

1515
class HttpAmazonESConnector extends HttpConnector {
@@ -94,7 +94,12 @@ class HttpAmazonESConnector extends HttpConnector {
9494
createRequest(params, reqParams) {
9595
const [pathname = '/', queryStr = ''] = (reqParams.path || '').split('?', 2);
9696

97-
const queryParams = queryStr ? queryString.parse(queryStr) : undefined;
97+
const queryParams = {};
98+
if (queryStr) {
99+
for (const [key, value] of new URLSearchParams(queryStr)) {
100+
queryParams[key] = value ?? '';
101+
}
102+
}
98103

99104
const request = new HttpRequest({
100105
...this.endpoint,

src/plugins/data_source/server/legacy/http_aws_es/connector.test.js

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,4 +233,58 @@ describe('createRequest', () => {
233233
expect(request.path).to.equal('/test');
234234
expect(request.query).to.be.empty;
235235
});
236+
237+
it('should treat query parameter without value as empty string', () => {
238+
const host = new Host();
239+
const connector = new Connector(host, {
240+
awsConfig: {
241+
region: 'us-east-1',
242+
credentials: defaultProvider(),
243+
},
244+
});
245+
246+
const params = { method: 'GET' };
247+
const reqParams = { method: 'GET', path: '/test?v', headers: {} };
248+
249+
const request = connector.createRequest(params, reqParams);
250+
251+
expect(request.path).to.equal('/test');
252+
expect(request.query).to.have.property('v', '');
253+
});
254+
255+
it('should treat query parameter with explicit empty value as empty string', () => {
256+
const host = new Host();
257+
const connector = new Connector(host, {
258+
awsConfig: {
259+
region: 'us-east-1',
260+
credentials: defaultProvider(),
261+
},
262+
});
263+
264+
const params = { method: 'GET' };
265+
const reqParams = { method: 'GET', path: '/test?v=', headers: {} };
266+
267+
const request = connector.createRequest(params, reqParams);
268+
269+
expect(request.path).to.equal('/test');
270+
expect(request.query).to.have.property('v', '');
271+
});
272+
273+
it('should correctly parse standard key-value query parameters', () => {
274+
const host = new Host();
275+
const connector = new Connector(host, {
276+
awsConfig: {
277+
region: 'us-east-1',
278+
credentials: defaultProvider(),
279+
},
280+
});
281+
282+
const params = { method: 'GET' };
283+
const reqParams = { method: 'GET', path: '/test?foo=bar&baz=qux', headers: {} };
284+
285+
const request = connector.createRequest(params, reqParams);
286+
287+
expect(request.path).to.equal('/test');
288+
expect(request.query).to.deep.equal({ foo: 'bar', baz: 'qux' });
289+
});
236290
});

0 commit comments

Comments
 (0)