Signature V4 canonicalized query calculation wrong with numeric parameter values

[simonkey]

Describe the bug

The calculation of the signature V4 canonicalized query is wrong for queries when a parameter key occurs multiple times and the parameter values are numeric. This results in a wrong signature.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

Correct calculation of the signature according to the standard.

Current Behavior

The signature is calculated wrong.

Reproduction Steps

Use a query which contains numeric parameter values.

E.g. sku=5033400&sku=10000010

Expected result: sku=10000010&sku=5033400

Current result: sku=5033400&sku=10000010

Possible Solution

Generally the SORT_STRING should be added to the corresponding sort function.
It can be found in SignatureV4::getCanonicalizedQuery in line 356.

The change from sort($v); to sort($v, SORT_STRING); resolves the issue.

Additional Information/Context

No response

SDK version used

3.369.9

Environment details (Version of PHP (php -v)? OS name and version, etc.)

PHP 8.3.28

[yenfryherrerafeliz]

Hi @simonkey, thanks for opening this issue. Would you please be able to provide more context on what you are doing, and provide any reproduction code so we can better assist you.

Thank you!

[simonkey]

Hi @yenfryherrerafeliz, yes I can provide an example.

The TestSignature class - it uses some fake service, region and credentials.

<?php

declare(strict_types=1);

use Aws\Credentials\Credentials;
use Aws\Signature\SignatureV4;
use GuzzleHttp\Client;
use GuzzleHttp\Exception\GuzzleException;
use GuzzleHttp\Psr7\Request;
use Psr\Http\Message\ResponseInterface;

class TestSignature {
  public function test(string $uri): ResponseInterface {
        $body = '';
        $request = new Request('GET', $uri,
        [
            SignatureV4::AMZ_CONTENT_SHA256_HEADER => hash('sha256', $body),
        ],$body);

        $signature = new SignatureV4('execute-api', 'eu-central-1');
        $credentials = new Credentials('accessKey', 'secretKey');

        $signedRequest =  $signature->signRequest($request, $credentials);  
        $client = new Client();
        try {
            $response = $client->send($signedRequest);
        }catch (GuzzleException $e) {

            throw $e;
        }

        return $response;
  }
        
}

Run some tests

$testSignature = new TestSignature();

// this fails, runs into a guzzle exception because the signature doesn't match
$testSignature->test('https://www.example.com/test?sku=5033400&sku=10000010');

// this works
$testSignature->test('https://www.example.com/test?sku=5033400&sku=5033401');

[simonkey]

Hi @yenfryherrerafeliz,

I've created a pull request for the issue which shows the fix for the problem and how to test it.

[yenfryherrerafeliz]

@simonkey, thanks for the contribution. I will give it a review as soon as possible.

Thank you!

[stobrien89]

Closing- the fix is available in today's release: 3.373.4

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.