putObjectAcl() error with symbols

[TAINCER]

Version of AWS SDK for PHP?

"aws/aws-sdk-php": "^3.105"

Version of PHP (php -v)?

PHP 7.0.33-0+deb9u3 (cli) (built: Mar 8 2019 10:01:24) ( NTS )

What issue did you see?

When the Key contains a symbol (In my case) like an @ (at) the functions returns an error (Exception).

root@debian:~/test2# php setPublic.php
PHP Fatal error:  Uncaught exception 'Aws\S3\Exception\S3Exception' with message 'Error executing "PutObjectAcl" on "https://SPACE_NAME.fra1.digitaloceanspaces.com/%40acex/mod.cpp?acl"; AWS HTTP error: Client error: `PUT https://SPACE_NAME.fra1.digitaloceanspaces.com/%40acex/mod.cpp?acl` resulted in a `403 Forbidden` response:
<?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><RequestId>tx000000000000009ee57cd-005d26 (truncated...)
 SignatureDoesNotMatch (client):  - <?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><RequestId>tx000000000000009ee57cd-005d2636b1-1c0f65-fra1a</RequestId><HostId>1c0f65-fra1a-fra1</HostId></Error>'

GuzzleHttp\Exception\ClientException: Client error: `PUT https://SPACE_NAME.fra1.digitaloceanspaces.com/%40acex/mod.cpp?acl` resulted in a `403 Forbidden` response:
<?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><RequestId>tx000000000000009ee57cd-005d26 (truncated...)
 in /root/test2/ven in /root/test2/vendor/aws/aws-sdk-php/src/WrappedHttpHandler.php on line 195

Steps to reproduce

<?php
require 'vendor/autoload.php';
use Aws\S3\S3Client;

$key = "PRIVATE_KEY";
$secret = "PRIVATE_SECRET";

$space = "SPACE_NAME";
$region = "REGION";
$host = "digitaloceanspaces.com";
$endpoint = "https://".$space.".".$region.".".$host;


$client = Aws\S3\S3Client::factory(array(
    'region' => $region,
    'version' => 'latest',
    'endpoint' => $endpoint,
    'credentials' => array(
              'key'    => $key,
              'secret' => $secret,
          ),
    'bucket_endpoint' => true,
    'signature_version' => 'v4-unsigned-body'
  ));

  $aclHeader = ["ACL" => "public-read"];
  $acl = array_merge(array("Bucket" => $space, "Key" => '@acex/mod.cpp'), $aclHeader);
  
  $client->putObjectAcl($acl);

Additional context

I used the endpoint of Digitalocean Spaces, which shouldn't make any difference, but just in case.

[diehlaws]

Hi @TAINCERcs, thanks for reaching out to us. Unfortunately I'm not able to reproduce this behavior with objects in S3, however I do see this behavior when attempting to interact with objects in DigitalOcean Spaces that have a key which contains a @.

$ php putObjectAclS3.php 
Using AWS SDK for PHP version 3.107.0
Putting Object ACL at alex-sdk/php/1846/noatsign/test:
class Aws\Result#180 (2) {
  private $data =>
  array(2) {
    'RequestCharged' =>
    string(0) ""
    '@metadata' =>
    array(4) {
      'statusCode' =>
      int(200)
      'effectiveUri' =>
      string(70) "https://alex-sdk.s3.us-west-2.amazonaws.com/php/1846/noatsign/test?acl"
      'headers' =>
      array(5) {
        ...
      }
      'transferStats' =>
      array(1) {
        ...
      }
    }
  }
  private $monitoringEvents =>
  array(0) {
  }
}
Putting Object ACL at alex-sdk/php/1846/@atsign/test:
class Aws\Result#191 (2) {
  private $data =>
  array(2) {
    'RequestCharged' =>
    string(0) ""
    '@metadata' =>
    array(4) {
      'statusCode' =>
      int(200)
      'effectiveUri' =>
      string(71) "https://alex-sdk.s3.us-west-2.amazonaws.com/php/1846/%40atsign/test?acl"
      'headers' =>
      array(5) {
        ...
      }
      'transferStats' =>
      array(1) {
        ...
      }
    }
  }
  private $monitoringEvents =>
  array(0) {
  }
}

$ php putObjectAclDO.php 
Using AWS SDK for PHP version 3.107.0
Putting Object ACL at alex-sdk/php/1846/noatsign/test:
class Aws\Result#136 (2) {
  private $data =>
  array(2) {
    'RequestCharged' =>
    string(0) ""
    '@metadata' =>
    array(4) {
      'statusCode' =>
      int(200)
      'effectiveUri' =>
      string(71) "https://alex-sdk.fra1.digitaloceanspaces.com/php/1846/noatsign/test?acl"
      'headers' =>
      array(5) {
        ...
      }
      'transferStats' =>
      array(1) {
        ...
      }
    }
  }
  private $monitoringEvents =>
  array(0) {
  }
}
Putting Object ACL at alex-sdk/php/1846/@atsign/test:
Error Putting Object ACL at alex-sdk/php/1846/@atsign/test:
exception 'Aws\S3\Exception\S3Exception' with message 'Error executing "PutObjectAcl" on "https://alex-sdk.fra1.digitaloceanspaces.com/php/1846/%40atsign/test?acl"; AWS HTTP error: Client error: `PUT https://alex-sdk.fra1.digitaloceanspaces.com/php/1846/%40atsign/test?acl` resulted in a `403 Forbidden` response:
<?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><RequestId>tx00000000000000825f170-005d27 (truncated...)
 SignatureDoesNotMatch (client):  - <?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><RequestId>tx00000000000000825f170-005d27ba6e-1b7b64-fra1a</RequestId><HostId>1b7b64-fra1a-fra1</HostId></Error>'

GuzzleHttp\Exception\ClientException: Client error: `PUT https://alex-sdk.fra1.digitaloceanspaces.com/php/1846/%40atsign/test?acl` resulted in a `403 Forbidden` response:
<?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><RequestId>tx00000000000000825f170-005d27 (truncated...)

Since DigitalOcean Spaces is not an Amazon product I cannot deterministically say what exactly is causing this behavior. That being said, I suspect it is because DigitalOcean Spaces does not appear to perform URL encoding on object URLs in the same way Amazon S3 does, so when the AWS SDK for PHP (or, more specifically, the GuzzleHttp package used by the SDK) url-encodes the request path before sending out the request DigitalOcean does not url-decode the request path which results in a signature mismatch between the canonical URI (php/1846/@atsign/test) present in the request signature and the object being requested (php/1846/%40atsign/test).

Reaching out to DigitalOcean's support team may confirm that this is the case (or show a different cause for this behavior) and could result in Spaces adopting URL encoding for their object URIs to more closely resemble Amazon S3.