Whether an object key is one the storage access checks will compare at all. A key that fails is refused (treated as
an object the caller may not read) rather than canonicalized, because its meaning depends on the provider:
a . or .. path segment, including one padded with whitespace or zero-width characters — a hierarchical
provider (Box, Dropbox, Google Drive, SharePoint) may resolve it as traversal, so the object served need not be
the one compared;
a backslash — some providers and URL layers treat it as a path separator;
a percent-encoded /, \, . or control character (%2F, %5C, %2E, %00–%1F, %7F) — a pre-signed URL
carries the key in its path, where the provider decodes it, so hr%2Fsecret.pdf would be compared as one segment and
served as hr/secret.pdf. A literal % followed by anything else (50% off.pdf, %20) is allowed;
a raw control character (including NUL).
An empty or whitespace-only key is not unsafe — it names the root, which no MJ: Files row tracks.
Whether an object key is one the storage access checks will compare at all. A key that fails is refused (treated as an object the caller may not read) rather than canonicalized, because its meaning depends on the provider:
.or..path segment, including one padded with whitespace or zero-width characters — a hierarchical provider (Box, Dropbox, Google Drive, SharePoint) may resolve it as traversal, so the object served need not be the one compared;/,\,.or control character (%2F,%5C,%2E,%00–%1F,%7F) — a pre-signed URL carries the key in its path, where the provider decodes it, sohr%2Fsecret.pdfwould be compared as one segment and served ashr/secret.pdf. A literal%followed by anything else (50% off.pdf,%20) is allowed;An empty or whitespace-only key is not unsafe — it names the root, which no
MJ: Filesrow tracks.