(paimon) branch master updated: [api] Use UTF-8 for DLFDefaultSigner signatures (#10468)

[lzljs3620320]

This is an automated email from the ASF dual-hosted git repository.

JingsongLi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/paimon.git


The following commit(s) were added to refs/heads/master by this push:
     new 50e121828e [api] Use UTF-8 for DLFDefaultSigner signatures (#10468)
50e121828e is described below

commit 50e121828e59fd787ed6b9a6842b176f57ff6ea8
Author: Ran Tao <chucheng...@gmail.com>
AuthorDate: Fri Oct 9 21:53:21 2026 +0800

    [api] Use UTF-8 for DLFDefaultSigner signatures (#10468)
---
 .../apache/paimon/rest/auth/DLFDefaultSigner.java  |  5 ++-
 .../paimon/rest/auth/DLFRequestSignerTest.java     | 46 ++++++++++++++++++++++
 2 files changed, 49 insertions(+), 2 deletions(-)

diff --git 
a/paimon-api/src/main/java/org/apache/paimon/rest/auth/DLFDefaultSigner.java 
b/paimon-api/src/main/java/org/apache/paimon/rest/auth/DLFDefaultSigner.java
index d572afa88c..624b061718 100644
--- a/paimon-api/src/main/java/org/apache/paimon/rest/auth/DLFDefaultSigner.java
+++ b/paimon-api/src/main/java/org/apache/paimon/rest/auth/DLFDefaultSigner.java
@@ -138,7 +138,8 @@ public class DLFDefaultSigner implements DLFRequestSigner {
                                 dateTime,
                                 String.format("%s/%s/%s/%s", date, region, 
PRODUCT, REQUEST_TYPE),
                                 sha256Hex(canonicalRequest));
-        byte[] dateKey = hmacSha256(("aliyun_v4" + 
dlfToken.getAccessKeySecret()).getBytes(), date);
+        byte[] dateKey =
+                hmacSha256(("aliyun_v4" + 
dlfToken.getAccessKeySecret()).getBytes(UTF_8), date);
         byte[] dateRegionKey = hmacSha256(dateKey, region);
         byte[] dateRegionServiceKey = hmacSha256(dateRegionKey, PRODUCT);
         byte[] signingKey = hmacSha256(dateRegionServiceKey, REQUEST_TYPE);
@@ -169,7 +170,7 @@ public class DLFDefaultSigner implements DLFRequestSigner {
             SecretKeySpec secretKeySpec = new SecretKeySpec(key, HMAC_SHA256);
             Mac mac = Mac.getInstance(HMAC_SHA256);
             mac.init(secretKeySpec);
-            return mac.doFinal(data.getBytes());
+            return mac.doFinal(data.getBytes(UTF_8));
         } catch (Exception e) {
             throw new RuntimeException("Failed to calculate HMAC-SHA256", e);
         }
diff --git 
a/paimon-api/src/test/java/org/apache/paimon/rest/auth/DLFRequestSignerTest.java
 
b/paimon-api/src/test/java/org/apache/paimon/rest/auth/DLFRequestSignerTest.java
index e1b67e3a9e..0398517911 100644
--- 
a/paimon-api/src/test/java/org/apache/paimon/rest/auth/DLFRequestSignerTest.java
+++ 
b/paimon-api/src/test/java/org/apache/paimon/rest/auth/DLFRequestSignerTest.java
@@ -165,6 +165,31 @@ public class DLFRequestSignerTest {
         assertTrue(authorization.startsWith("acs "));
     }
 
+    @Test
+    public void testDefaultSignerAsciiAuthorization() throws Exception {
+        assertDefaultSignerAuthorization(
+                "secret",
+                "cn-hangzhou",
+                
"732e9db9eeb4ea707238324e6c9de13a7c780bcc6cd977e8427073774efced42");
+    }
+
+    @Test
+    public void testDefaultSignerAuthorizationWithNonAsciiSecret() throws 
Exception {
+        assertDefaultSignerAuthorization(
+                "secret\u5bc6\u94a5",
+                "cn-hangzhou",
+                
"d242e1ee55bd9fc50de6793ace6e681b1edff5d25f7e158de3c84beb1c7f5410");
+    }
+
+    @Test
+    public void testDefaultSignerAuthorizationWithNonAsciiHmacInput() throws 
Exception {
+        // A synthetic region exercises HMAC input encoding independently of 
secret encoding.
+        assertDefaultSignerAuthorization(
+                "secret",
+                "region\u4e2d",
+                
"993e26f338cc437fd838e508da5b0e0a022514c5661106bb63ca9172eccb1025");
+    }
+
     @Test
     public void testIdentifier() {
         DLFDefaultSigner defaultSigner = new DLFDefaultSigner("region");
@@ -347,4 +372,25 @@ public class DLFRequestSignerTest {
         // Verify all generated nonces are unique
         assertEquals((long) threadCount * iterationsPerThread, nonces.size());
     }
+
+    private void assertDefaultSignerAuthorization(
+            String secret, String region, String expectedSignature) throws 
Exception {
+        DLFDefaultSigner signer = new DLFDefaultSigner(region);
+        DLFToken token = new DLFToken("id", secret, null, null);
+        String host = "example.com";
+        String body = "body";
+        Instant now = Instant.parse("2025-04-16T03:44:46Z");
+        RESTAuthParameter request =
+                new RESTAuthParameter(
+                        "/path", Collections.singletonMap("q", "value"), 
"POST", body);
+        Map<String, String> headers = signer.signHeaders(body, now, null, 
host);
+
+        // Fixed signatures were calculated independently using UTF-8 for all 
protocol strings.
+        assertEquals(
+                "DLF4-HMAC-SHA256 Credential=id/20250416/"
+                        + region
+                        + "/DlfNext/aliyun_v4_request,Signature="
+                        + expectedSignature,
+                signer.authorization(request, token, host, headers));
+    }
 }