fix: verify presigned S3 URLs against public host

src/routes/s3.ts

@@ -160,7 +160,8 @@ export const handleS3Request = async (req: Request): Promise<Response> => {
     }
 
     // Standard object operations
-    if (method === 'GET') return handleGetObject(bucket, key, searchParams, reqId);
+    if (method === 'GET')
+      return handleGetObject(bucket, key, searchParams, headers, req.url, reqId);
     if (method === 'HEAD') return handleHeadObject(bucket, key, reqId);
     if (method === 'PUT') return handlePutObject(bucket, key, searchParams, headers, req, reqId);
     if (method === 'DELETE') return handleDeleteObject(bucket, key, reqId);
@@ -264,21 +265,23 @@ const handleGetObject = async (
   bucket: string,
   key: string,
   searchParams: URLSearchParams,
+  headers: Record<string, string>,
+  requestUrl: string,
   reqId: string,
 ): Promise<Response> => {
   if (searchParams.has('X-Amz-Signature')) {
-    const fullUrl = `http://localhost/${bucket}/${key}?${searchParams.toString()}`;
+    const presignedResult = await verifyPresignedUrl({
-    const presignedResult = await verifyPresignedUrl(
+      url: requestUrl,
-      fullUrl,
+      method: 'GET',
-      'GET',
+      headers,
-      config.s3AccessKey,
+      s3AccessKey: config.s3AccessKey,
-      config.s3SecretKey,
+      s3SecretKey: config.s3SecretKey,
-      REGION,
+      region: REGION,
-    );
+    });
     if (!presignedResult.isValid) {
       return s3ErrorResponse(
-        'AccessDenied',
+        presignedResult.errorCode || 'AccessDenied',
-        'Request has expired',
+        'Presigned URL verification failed',
         `/${bucket}/${key}`,
         403,
         reqId,

src/utils/s3/auth.ts

@@ -9,6 +9,16 @@ export interface SigV4Result {
   errorCode?: string;
 }
 
+export interface VerifyPresignedUrlInput {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  s3AccessKey: string;
+  s3SecretKey: string;
+  region: string;
+  now?: Date;
+}
+
 const SERVICE = 's3';
 const TERMINATION = 'aws4_request';
 
@@ -101,16 +111,26 @@ const normalizeUri = (uri: string): string => {
   return decodeURIComponent(uri);
 };
 
-const buildCanonicalQueryString = (searchParams: URLSearchParams): string => {
+const awsEncode = (value: string): string =>
-  const params: string[] = [];
+  encodeURIComponent(value).replace(
-  const keys = Array.from(searchParams.keys()).sort();
+    /[!'()*]/g,
-  for (const key of keys) {
+    (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`,
-    const values = searchParams.getAll(key).sort();
+  );
-    for (const value of values) {
+
-      params.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+export const buildCanonicalQueryString = (
-    }
+  searchParams: URLSearchParams,
+  excludeKeys: Set<string> = new Set(),
+): string => {
+  const pairs: Array<[string, string]> = [];
+  for (const [key, value] of searchParams.entries()) {
+    if (!excludeKeys.has(key)) pairs.push([key, value]);
   }
-  return params.join('&');
+  pairs.sort(([ak, av], [bk, bv]) => {
+    const a = `${awsEncode(ak)}=${awsEncode(av)}`;
+    const b = `${awsEncode(bk)}=${awsEncode(bv)}`;
+    return a.localeCompare(b);
+  });
+  return pairs.map(([key, value]) => `${awsEncode(key)}=${awsEncode(value)}`).join('&');
 };
 
 const getHashedPayload = async (
@@ -191,88 +211,97 @@ export const verifySignature = async (
   };
 };
 
-export const verifyPresignedUrl = async (
+const parseAmzDateUtc = (amzDate: string): Date | null => {
-  url: string,
+  const match = amzDate.match(/^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/);
-  method: string,
+  if (!match) return null;
-  s3AccessKey: string,
+  const [, year, month, day, hour, minute, second] = match;
-  s3SecretKey: string,
+  return new Date(
-  region: string,
+    Date.UTC(
-): Promise<SigV4Result> => {
+      Number.parseInt(year, 10),
-  const parsedUrl = new URL(url);
+      Number.parseInt(month, 10) - 1,
-  const queryParams = Object.fromEntries(parsedUrl.searchParams.entries());
+      Number.parseInt(day, 10),
+      Number.parseInt(hour, 10),
+      Number.parseInt(minute, 10),
+      Number.parseInt(second, 10),
+    ),
+  );
+};
 
-  const algorithm = queryParams['X-Amz-Algorithm'];
+export const verifyPresignedUrl = async ({
-  const credential = queryParams['X-Amz-Credential'];
+  url,
-  const signedHeaders = queryParams['X-Amz-SignedHeaders'];
+  method,
-  const signature = queryParams['X-Amz-Signature'];
+  headers,
-  const expires = parseInt(queryParams['X-Amz-Expires'] || '0', 10);
+  s3AccessKey,
-  const amzDate = queryParams['X-Amz-Date'];
+  s3SecretKey,
+  region,
+  now = new Date(),
+}: VerifyPresignedUrlInput): Promise<SigV4Result> => {
+  const parsedUrl = new URL(url);
+  const searchParams = parsedUrl.searchParams;
+
+  const algorithm = searchParams.get('X-Amz-Algorithm');
+  const credential = searchParams.get('X-Amz-Credential');
+  const signedHeaders = searchParams.get('X-Amz-SignedHeaders');
+  const signature = searchParams.get('X-Amz-Signature');
+  const expiresText = searchParams.get('X-Amz-Expires');
+  const amzDate = searchParams.get('X-Amz-Date');
 
   if (
-    !algorithm ||
     algorithm !== 'AWS4-HMAC-SHA256' ||
     !credential ||
+    !signedHeaders ||
     !signature ||
-    !expires ||
+    !expiresText ||
     !amzDate
   ) {
     return { isValid: false, credential: null, errorCode: 'AccessDenied' };
   }
 
-  // Check expiration
+  const expires = Number.parseInt(expiresText, 10);
-  const dateObj = new Date(
+  const signedAt = parseAmzDateUtc(amzDate);
-    parseInt(amzDate.substring(0, 4), 10),
+  if (!Number.isFinite(expires) || expires <= 0 || !signedAt) {
-    parseInt(amzDate.substring(4, 6), 10) - 1,
+    return { isValid: false, credential: null, errorCode: 'AccessDenied' };
-    parseInt(amzDate.substring(6, 8), 10),
+  }
-    parseInt(amzDate.substring(9, 11), 10),
+  if (now.getTime() > signedAt.getTime() + expires * 1000) {
-    parseInt(amzDate.substring(11, 13), 10),
-    parseInt(amzDate.substring(13, 15), 10),
-  );
-  const expiresMs = expires * 1000;
-  if (Date.now() > dateObj.getTime() + expiresMs) {
     return { isValid: false, credential: null, errorCode: 'AccessDenied' };
   }
 
   const credParts = credential.split('/');
-  const presignedAccessKey = credParts[0];
+  if (credParts.length !== 5) {
-  if (presignedAccessKey !== s3AccessKey) {
+    return { isValid: false, credential: null, errorCode: 'AccessDenied' };
+  }
+  const [accessKey, dateStamp, credentialRegion, service, termination] = credParts;
+  if (
+    accessKey !== s3AccessKey ||
+    credentialRegion !== region ||
+    service !== SERVICE ||
+    termination !== TERMINATION
+  ) {
     return { isValid: false, credential: null, errorCode: 'SignatureDoesNotMatch' };
   }
-  const dateStamp = credParts[1] || amzDate.substring(0, 8);
 
-  const canonicalUri = normalizeUri(parsedUrl.pathname);
-
-  const sortedParams = new URLSearchParams();
-  const paramKeys = Object.keys(queryParams).sort();
-  for (const key of paramKeys) {
-    if (key !== 'X-Amz-Signature') {
-      sortedParams.append(key, queryParams[key]);
-    }
-  }
-  const canonicalQueryString = buildCanonicalQueryString(sortedParams);
-
-  // Build canonical headers for presigned URL — only 'host' is typically signed
   const signedHeaderList = signedHeaders.split(';').filter(Boolean);
   const canonicalHeaders = signedHeaderList
-    .map((h) => `${h.toLowerCase()}:${h === 'host' ? parsedUrl.host : ''}\n`)
+    .map((headerName) => {
+      const lower = headerName.toLowerCase();
+      const value = lower === 'host' ? headers.host || parsedUrl.host : headers[lower] || '';
+      return `${lower}:${value.trim()}\n`;
+    })
     .join('');
 
-  const hashedPayload = 'UNSIGNED-PAYLOAD';
+  const canonicalRequest = `${method}\n${normalizeUri(parsedUrl.pathname)}\n${buildCanonicalQueryString(searchParams, new Set(['X-Amz-Signature']))}\n${canonicalHeaders}\n${signedHeaders}\nUNSIGNED-PAYLOAD`;
-
-  const canonicalRequest = `${method}\n${canonicalUri}\n${canonicalQueryString}\n${canonicalHeaders}\n${signedHeaders}\n${hashedPayload}`;
   const hashedCanonicalRequest = await sha256Hex(canonicalRequest);
-
+  const credentialScope = `${dateStamp}/${region}/${SERVICE}/${TERMINATION}`;
-  const credentialScope = `${dateStamp}/${region}/s3/aws4_request`;
   const stringToSign = `AWS4-HMAC-SHA256\n${amzDate}\n${credentialScope}\n${hashedCanonicalRequest}`;
-
+  const expectedSignature = await hmacHex(
-  const signingKey = await getSigningKey(s3SecretKey, dateStamp, region);
+    await getSigningKey(s3SecretKey, dateStamp, region),
-  const expectedSignature = await hmacHex(signingKey, stringToSign);
+    stringToSign,
+  );
 
   if (expectedSignature !== signature) {
     return { isValid: false, credential: null, errorCode: 'SignatureDoesNotMatch' };
   }
-
+  return { isValid: true, credential: { accessKey, date: dateStamp, region, service } };
-  return { isValid: true, credential: null };
 };
 
 export const isS3Request = (headers: Record<string, string>): boolean => {

test/s3-auth.test.ts

@@ -73,14 +73,95 @@ describe('S3 Auth (SigV4)', () => {
   });
 
   it('rejects malformed presigned URLs', async () => {
-    const result = await verifyPresignedUrl(
+    const result = await verifyPresignedUrl({
-      'http://localhost/bucket/key',
+      url: 'http://localhost/bucket/key',
-      'GET',
+      method: 'GET',
-      'key',
+      headers: { host: 'localhost' },
-      'secret',
+      s3AccessKey: 'key',
-      'us-east-1',
+      s3SecretKey: 'secret',
-    );
+      region: 'us-east-1',
+    });
     expect(result.isValid).toBe(false);
     expect(result.errorCode).toBe('AccessDenied');
   });
+
+  const sha256hex = (data: string): string => {
+    const h = new Bun.CryptoHasher('sha256');
+    h.update(data);
+    return Array.from(h.digest())
+      .map((b) => b.toString(16).padStart(2, '0'))
+      .join('');
+  };
+
+  const hmacSha256 = (key: Uint8Array, msg: string): Uint8Array => {
+    const h = new Bun.CryptoHasher('sha256', key);
+    h.update(msg);
+    return h.digest();
+  };
+
+  const signingKey = (secret: string, date: string, region: string): Uint8Array => {
+    const enc = (s: string) => new TextEncoder().encode(s);
+    let k = hmacSha256(enc(`AWS4${secret}`), date);
+    k = hmacSha256(k, region);
+    k = hmacSha256(k, 's3');
+    return hmacSha256(k, 'aws4_request');
+  };
+
+  const hex = (bytes: Uint8Array): string =>
+    Array.from(bytes)
+      .map((b) => b.toString(16).padStart(2, '0'))
+      .join('');
+
+  it('verifies presigned GET using the public request host', async () => {
+    const accessKey = 'teleuploader-admin';
+    const secret = 'unit-test-secret';
+    const host = 'upload.example.test';
+    const path = '/bucket/key.txt';
+    const amzDate = '20260707T120000Z';
+    const dateStamp = '20260707';
+    const sp = new URLSearchParams({
+      'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
+      'X-Amz-Credential': `${accessKey}/${dateStamp}/us-east-1/s3/aws4_request`,
+      'X-Amz-Date': amzDate,
+      'X-Amz-Expires': '3600',
+      'X-Amz-SignedHeaders': 'host',
+    });
+    const canonicalQs = [...sp.entries()]
+      .sort(([aKey, aVal], [bKey, bVal]) => `${aKey}=${aVal}`.localeCompare(`${bKey}=${bVal}`))
+      .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+      .join('&');
+    const canonicalRequest = `GET\n${path}\n${canonicalQs}\nhost:${host}\n\nhost\nUNSIGNED-PAYLOAD`;
+    const hashedCanonical = sha256hex(canonicalRequest);
+    const scope = `${dateStamp}/us-east-1/s3/aws4_request`;
+    const stringToSign = `AWS4-HMAC-SHA256\n${amzDate}\n${scope}\n${hashedCanonical}`;
+    const sig = hex(hmacSha256(signingKey(secret, dateStamp, 'us-east-1'), stringToSign));
+    sp.set('X-Amz-Signature', sig);
+
+    const result = await verifyPresignedUrl({
+      url: `https://${host}${path}?${sp.toString()}`,
+      method: 'GET',
+      headers: { host },
+      s3AccessKey: accessKey,
+      s3SecretKey: secret,
+      region: 'us-east-1',
+      now: new Date('2026-07-07T12:05:00Z'),
+    });
+
+    expect(result.isValid).toBe(true);
+  });
+
+  it('rejects presigned URLs signed for a different host', async () => {
+    const result = await verifyPresignedUrl({
+      url: 'https://wrong.example.test/bucket/key.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=teleuploader-admin%2F20260707%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260707T120000Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=00',
+      method: 'GET',
+      headers: { host: 'upload.example.test' },
+      s3AccessKey: 'teleuploader-admin',
+      s3SecretKey: 'unit-test-secret',
+      region: 'us-east-1',
+      now: new Date('2026-07-07T12:05:00Z'),
+    });
+
+    expect(result.isValid).toBe(false);
+    expect(result.errorCode).toBe('SignatureDoesNotMatch');
+  });
 });