Re: [PR] fix: canonicalize multiple whitespaces in SigV4 [arrow-rs-object-store]

["tustvold (via GitHub)" <gi...@apache.org>]

tustvold commented on code in PR #512:
URL: https://github.com/apache/arrow-rs-object-store/pull/512#discussion_r2443439527


##########
src/client/backoff.rs:
##########
@@ -110,7 +110,7 @@ impl Backoff {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use rand::rand_core::impls::fill_bytes_via_next;
+    use rand_core::impls::fill_bytes_via_next;

Review Comment:
   Why this change?



##########
src/aws/credential.rs:
##########
@@ -423,6 +423,10 @@ fn canonicalize_headers(header_map: &HeaderMap) -> (String, String) {
     let mut value_bytes = 0;
     let mut key_bytes = 0;
 
+    fn normalize_whitespace(s: &str) -> String {
+        s.split_whitespace().collect::<Vec<_>>().join(" ")

Review Comment:
   The specification only says to convert consecutive spaces, not arbitrary whitespace (although in practice unicode characters or control characters in headers can cause interesting things to happen).
   
   



##########
src/aws/credential.rs:
##########
@@ -452,7 +456,7 @@ fn canonicalize_headers(header_map: &HeaderMap) -> (String, String) {
             if value_idx != 0 {
                 canonical_headers.push(',');
             }
-            canonical_headers.push_str(value.trim());
+            canonical_headers.push_str(&normalize_whitespace(value));

Review Comment:
   It seems rather wasteful to allocate both a Vec and a String only to append there contents to another string.
   
   Perhaps we could just do something like (not tested)
   
   ```
   let mut iter = value.trim().split("  ").filter(|x| !x.is_empty());
   if let Some(first) = iter.next() {
       canonical_headers.push(first);
       for x in iter {
          canonical_headers.push(' ');
          canonical_headers.push(x);
       }
   }
   ```
   



##########
Cargo.toml:
##########
@@ -54,6 +54,7 @@ hyper = { version = "1.2", default-features = false, optional = true }
 md-5 = { version = "0.10.6", default-features = false, optional = true }
 quick-xml = { version = "0.38.0", features = ["serialize", "overlapped-lists"], optional = true }
 rand = { version = "0.9", default-features = false, features = ["std", "std_rng", "thread_rng"], optional = true }
+rand_core = "0.9.3"  # ensure this matches rand's requirement

Review Comment:
   This change seems unrelated (and brittle)?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org