From c4626888460dfc4fbefa694a74412c37bb1b80ff Mon Sep 17 00:00:00 2001
From: Bert Blommers <bblommers@users.noreply.github.com>
Date: Wed, 28 Sep 2022 09:33:27 +0000
Subject: [PATCH] S3 - UploadFile with ChecksumAlgorithm changes body content
 (#5498)

---
 moto/s3/responses.py     |  21 ++++++++++++++++++++-
 tests/test_s3/red.jpg    | Bin 633 -> 0 bytes
 tests/test_s3/test_s3.py |  18 ++++++++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)
 delete mode 100644 tests/test_s3/red.jpg

diff --git a/moto/s3/responses.py b/moto/s3/responses.py
index cdb9cf211..49221db9c 100644
--- a/moto/s3/responses.py
+++ b/moto/s3/responses.py
@@ -1104,6 +1104,15 @@ class S3Response(BaseResponse):
             line = body_io.readline()
         return bytes(new_body)
 
+    def _handle_encoded_body(self, body, content_length):
+        body_io = io.BytesIO(body)
+        # first line should equal '{content_length}\r\n
+        body_io.readline()
+        # Body contains actual data next
+        return body_io.read(content_length)
+        # last line should equal
+        # amz-checksum-sha256:<..>\r\n
+
     @amzn_request_id
     def key_response(self, request, full_url, headers):
         # Key and Control are lumped in because splitting out the regex is too much of a pain :/
@@ -1384,12 +1393,22 @@ class S3Response(BaseResponse):
         checksum_header = f"x-amz-checksum-{checksum_algorithm.lower()}"
         checksum_value = request.headers.get(checksum_header)
         if not checksum_value and checksum_algorithm:
-            search = re.search(r"x-amz-checksum-\w+:(\w+={1,2})", body.decode())
+            # Extract the checksum-value from the body first
+            search = re.search(b"x-amz-checksum-\w+:(\w+={1,2})", body)
             checksum_value = search.group(1) if search else None
 
         if checksum_value:
             response_headers.update({checksum_header: checksum_value})
 
+        # Extract the actual data from the body second
+        if (
+            request.headers.get("x-amz-content-sha256", None)
+            == "STREAMING-UNSIGNED-PAYLOAD-TRAILER"
+        ):
+            body = self._handle_encoded_body(
+                body, int(request.headers["x-amz-decoded-content-length"])
+            )
+
         bucket_key_enabled = request.headers.get(
             "x-amz-server-side-encryption-bucket-key-enabled", None
         )
diff --git a/tests/test_s3/red.jpg b/tests/test_s3/red.jpg
deleted file mode 100644
index 6fb9aed7c88160a18eb8cb0b412f80a7a47ffced..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 633
zcmex=<NpH&0WUXCHwH#V1_nk3Mh1rew;7xnIM~?O*;qN)+1WWcIk<R4czL+Fc_f8|
z`9)-<<mF_gWMmXn^wbrUbd+UeG|V-13=B<7Oyt!qZ7qy!^o&i6K!z}Ka&q!;^GNXW
zN*F21C>oIr{vTiv<X~WCU}9!eVqg+vWEN!ne}qAvfq{{g5eyihfRTxrg_Vt+gOiK<
z{}G0*0t`%y%*;$I%&e>|EDQ{cwTw*63@n1ILW+itY{G$w>`H|qMvW5}awt1(JSZA;
z@q>zSQc)8pmzcPOq?D?fx`w8fiK&^ng{76Vi>sTvho@I?NN8AiL}XNQN@`kqMrKxV
zNoiSmMP*fUOKV$uM`zch$y26In?7UatVN5LEM2yI#mZHiHgDOwZTpU$yAB;ba`f2o
z6DLnyx_ss8wd*%--g@}x@sp>|p1*kc>f@)+U%r0({^RE_kiQrin8CgR5fG1|`Ad+2
ziIItgg_(sN<S$01at1~wW<eHKMME|r$3XVPLSZGNMh+3Di3>L#<Wx2e`XHKAbdgI;
x#pI#tN08URJ|oU!O=S5D?lFYFZZYsMGcqs<G7B=;Gdy~+sO#tC@529Y0sxW-(3k)K

diff --git a/tests/test_s3/test_s3.py b/tests/test_s3/test_s3.py
index 625f127a4..427aad34d 100644
--- a/tests/test_s3/test_s3.py
+++ b/tests/test_s3/test_s3.py
@@ -808,6 +808,24 @@ def test_upload_from_file_to_presigned_url():
     os.remove("text.txt")
 
 
+@mock_s3
+def test_upload_file_with_checksum_algorithm():
+    random_bytes = b"\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xff\n\xdb\x00C\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\n"
+    with open("rb.tmp", mode="wb") as f:
+        f.write(random_bytes)
+    s3 = boto3.resource("s3", region_name=DEFAULT_REGION_NAME)
+    s3_client = boto3.client("s3", region_name=DEFAULT_REGION_NAME)
+    bucket = "mybucket"
+    s3_client.create_bucket(Bucket=bucket)
+    s3_client.upload_file(
+        "rb.tmp", bucket, "my_key.csv", ExtraArgs={"ChecksumAlgorithm": "SHA256"}
+    )
+    os.remove("rb.tmp")
+
+    actual_content = s3.Object(bucket, "my_key.csv").get()["Body"].read()
+    assert random_bytes == actual_content
+
+
 @mock_s3
 def test_put_chunked_with_v4_signature_in_body():
     bucket_name = "mybucket"