8 Commits

Include renames

Author	SHA1	Message	Date
Claude	af160e0f33	fix: audit S3 protocol — 15+ security & correctness fixes ... HIGH severity fixes: - H1: Bot token leak via 302 redirect — always proxy S3 GETs - H2: PUT TOCTOU race — add unique partial index (bucket_id, s3_key) WHERE NOT deleted - H3: GET/HEAD ignore conditional headers (If-Match, If-None-Match, etc.) - H4: Body payload hash not verified — add verifyBodyHash() post-stream check - H5: Header-based auth has no expiry check — add 15-min clock skew window - H7: Multipart abort does not delete parts — DELETE before UPDATE status - H8: CompleteMultipartUpload skips part number & etag verification - H9: XML regex fails on keys containing < — use non-greedy [\s\S]*? - H10: Path-style vs virtual-hosted key decode mismatch MEDIUM severity fixes: - M1: Add Date header fallback for x-amz-date - M2/M3: Validate service/termination in credential scope - M4: Temp file leak when forwardToStorage throws in handleUploadPart - M5: Multipart key consistency check (s3Key matches URL) - M7: Use stored content-type from multipart initiate - M9: Copy conditional headers skip when fileHash is null - M11: Add 1000-key limit on DeleteObjects - M13: Stricter bucket name validation (no .., no IP format) - M14: NaN partNumber bypasses validation LOW fixes: - normalizeUri: dot-segment removal per RFC 3986 - localeCompare -> byte-order comparison in canonical query string - Validate host in signed headers - Server: AmazonS3 header on all responses - x-amz-id-2 separate from x-amz-request-id - IPv6 handling in stripPort - Quiet element whitespace tolerance in XML parser - content-type: application/xml on empty 2xx responses - Duplicate interfaces/s3/ -> re-exports from utils/s3/ Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-29 08:02:28 +07:00
Claude	667921b100	chore: fix lint errors — duplicate import, unused imports, formatting ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-28 20:09:42 +07:00
Claude	002492626b	fix: secure SigV4, temp leaks, OOM risk, duplicate migration, and cache issues ... Security fixes: - SigV4 signature comparison now uses crypto.timingSafeEqual (timing attack fix) - AccessKey, region, and HMAC signature all timing-safe - Presigned URL expiry capped at 7 days (AWS spec compliance) - Removed duplicate migration import (dead code) Memory & leak fixes: - Temp file leak in createZip(): cleanup temp file on error in both utils/ and shared/utils/ - OOM risk in web-api/v1 upload: stream File to temp instead of arrayBuffer() - Removed duplicate migration import at startup Performance fixes: - Removed file.arrayBuffer() -> Bun.write() pattern in web-api-controller (stream + hash) Test improvements: - All fixes verified: 74/75 tests pass (1 pre-existing env config test) - S3 auth tests: 7/7 pass after timing-safe fix	2026-07-28 19:33:05 +07:00
asepharyana	8e6ccf2110	feat: S3 client compatibility — virtual-hosted style, CORS, presigned multi-method, ListMultipartUploads, edge case fixes ... - Virtual-hosted bucket detection from Host header (extractS3BucketFromHost) - S3 CORS headers + OPTIONS preflight + x-amz-id-2/HostId everywhere - Presigned GET/PUT/HEAD/DELETE via centralized auth (no GET-only restriction) - ListMultipartUploads with DB/xml helpers - UploadPart partNumber range validation (1-10000) - CompleteMultipartUpload ETag matching and ascending order validation - DeleteObjects quiet mode support - CopyObject URL-decode and conditional if-match/if-none-match - encoding-type=url support in ListObjects V1/V2 XML - Safe range-based prefix matching (replaces SQL LIKE) - STREAMING-AWS4-HMAC-SHA256-PAYLOAD → 501 NotImplemented - Traefik wildcard HostRegex for virtual-hosted style - S3_VHOST_DOMAINS config env var	2026-07-07 05:39:23 +07:00
asepharyana	5253fb384d	fix: verify presigned S3 URLs against public host	2026-07-07 04:21:01 +07:00
asepharyana	9a48fbf227	fix: satisfy deploy lint gate for S3 compatibility work ... - Apply Biome organize-import/formatting fixes across changed S3 files - Replace remaining string concatenations with template literals for lint - Make home page inline handlers explicit via window.* and add button types - Clean S3 auth lint issues with dot-property access and optional chaining - Keep GetObject proxy and production/S3 SDK tests passing Verification: - bun run lint (0 errors, 1 CSS specificity warning) - S3_SECRET_KEY=<env> bun test test/production-e2e.test.ts (29 pass) - S3_SECRET_KEY=<env> bun test test/s3-sdk.test.ts (20 pass) - bun test test/s3-auth.test.ts (5 pass)	2026-07-07 03:07:51 +07:00
asepharyana	084ff3fb9d	fix: add region validation, fix presigned URL canonical request (add method, fix headers), normalizeUri decode	2026-07-06 15:31:06 +07:00
asepharyana	ee758aa939	feat: add S3 SigV4 auth verification and XML builders	2026-07-06 14:56:39 +07:00