boto/boto — Issue #544: "/" character in signatures not being escaped properly
Author: garnaat
Created: 2012-02-02 14:17:29+00:00
State: open
Labels: Bug

For query-based API's like EC2, SQS, SimpleDB, etc. the StringToSign is calculated, the string is then signed via HMAC and the resulting digest is base64-encoded. This base64-encoded string is then included a query parameter in the URL. However, the "/" character is a valid output of base64 encoding and could end up in the URL string. The auth plug-in for query needs to make sure this character is properly escaped. It doesn't appear that this escaping is happening right now.