From 5f1999cc71f89d02e74f68d89cfa6f3f5b052aac Mon Sep 17 00:00:00 2001
From: Aditya Manthramurthy <donatello@users.noreply.github.com>
Date: Wed, 9 Nov 2022 16:41:16 -0800
Subject: [PATCH] fix: avoid URL unsafe chars in multipart upload ID (#16034)

---
 cmd/erasure-multipart.go         | 4 ++--
 cmd/object-api-input-checks.go   | 2 +-
 cmd/object-api-multipart_test.go | 5 +++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/cmd/erasure-multipart.go b/cmd/erasure-multipart.go
index b50719882..b0a7c399a 100644
--- a/cmd/erasure-multipart.go
+++ b/cmd/erasure-multipart.go
@@ -43,7 +43,7 @@ import (
 
 func (er erasureObjects) getUploadIDDir(bucket, object, uploadID string) string {
 	uploadUUID := uploadID
-	uploadBytes, err := base64.StdEncoding.DecodeString(uploadID)
+	uploadBytes, err := base64.RawURLEncoding.DecodeString(uploadID)
 	if err == nil {
 		slc := strings.SplitN(string(uploadBytes), ".", 2)
 		if len(slc) == 2 {
@@ -432,7 +432,7 @@ func (er erasureObjects) newMultipartUpload(ctx context.Context, bucket string,
 		partsMetadata[index].Metadata = userDefined
 	}
 	uploadUUID := mustGetUUID()
-	uploadID := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s.%s", globalDeploymentID, uploadUUID)))
+	uploadID := base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf("%s.%s", globalDeploymentID, uploadUUID)))
 	uploadIDPath := er.getUploadIDDir(bucket, object, uploadUUID)
 
 	// Write updated `xl.meta` to all disks.
diff --git a/cmd/object-api-input-checks.go b/cmd/object-api-input-checks.go
index a85f32316..0bb51dfc2 100644
--- a/cmd/object-api-input-checks.go
+++ b/cmd/object-api-input-checks.go
@@ -109,7 +109,7 @@ func checkListMultipartArgs(ctx context.Context, bucket, prefix, keyMarker, uplo
 				KeyMarker:      keyMarker,
 			}
 		}
-		_, err := base64.StdEncoding.DecodeString(uploadIDMarker)
+		_, err := base64.RawURLEncoding.DecodeString(uploadIDMarker)
 		if err != nil {
 			logger.LogIf(ctx, err)
 			return MalformedUploadID{
diff --git a/cmd/object-api-multipart_test.go b/cmd/object-api-multipart_test.go
index ad965e142..ab2bbfd8b 100644
--- a/cmd/object-api-multipart_test.go
+++ b/cmd/object-api-multipart_test.go
@@ -1051,9 +1051,10 @@ func testListMultipartUploads(obj ObjectLayer, instanceType string, t TestErrHan
 			fmt.Errorf("Invalid combination of uploadID marker '%s' and marker '%s'", "abc", "asia/europe/"), false,
 		},
 		{
-			bucketNames[0], "asia", "asia/europe", "abc", "", 0,
+			// Contains a base64 padding character
+			bucketNames[0], "asia", "asia/europe", "abc=", "", 0,
 			ListMultipartsInfo{},
-			fmt.Errorf("Malformed upload id %s", "abc"), false,
+			fmt.Errorf("Malformed upload id %s", "abc="), false,
 		},
 
 		// Setting up valid case of ListMultiPartUploads.