aws_sigv4: '+' and space in query get both encoded to %20

[nunojpg]

[bagder]

The code quite deliberately "normalizes" + (and space) to %20 when part of the query.

Can you find any documentation that clearly states how those are supposed to be handled?

[nunojpg]

https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

The space character is a reserved character and must be encoded as "%20" (and not as "+").

There is nothing special on sigv4, they just don't want you to encode spaces as +, as we already don't do.

The fix in the code was assuming we did that mistake before, and trying to fix it later. But that breaks the original '+', that was never a space!

This is tested against AWS S3.

Of course if both space and + get converted to %20 (which makes no sense!), it would be even a vector of attack of the API!

[bagder]

The space character is a reserved character and must be encoded as "%20" (and not as "+").
There is nothing special on sigv4, they just don't want you to encode spaces as +, as we already don't do.

but curl works on a URL provided by a user and then someone can use a + in the query part...

[nunojpg]

This is what I am trying to do. I need a + in the query parameter. And it stopped working when that code was added in 8.14 or so.