Validation of the SES message signature fails because of the diamonds in the Message field

0

We have an Inbound SES rule that sends SNS notifications. Sometimes arrived SES notification contains illegal unicode characters in the Message field that appears as diamonds (the Message field contains parsed EML headers). In this case the SNS signature fails.

How is it possible? The SNS signature should be created by AWS from the same message that is sent to SNS queue, isn't it? Maybe, AWS first of all creates signature from binary data that is later sent to S3, and after that sends already broken JSON string with diamonds to SNS?

P.S. I can provide SNS MessageId and S3 topicArn/objectKey per request.

2개 답변
0

Hello,

Please refer the below Github issue which talks about the similar issue :

[+] https://github.com/aws/aws-sdk-java/issues/2340

As suggested in the above Github issue comments, kindly try providing an explicit Charset for the signature checker.

Moving ahead, if the issue still persists, we would require further details from your end which are non-public information, like your SNS message ids/request ids in order to investigate this issue further. Hence, please open a support case with AWS Premium Support using the below link and kindly share the necessary details so that we can further investigate this issue and find the root cause.

[+] AWS Premium Support: https://aws.amazon.com/premiumsupport/

[+] Create a case: https://support.console.aws.amazon.com/support/home#/case/create

AWS
지원 엔지니어
답변함 5달 전
0

I tried to validate it with an official AWS SNS validator and it still doesn't work:

let MessageValidator = require('sns-validator');
let validator = new MessageValidator();
validator.encoding = 'utf8';
let notification = require('../notification.json');
validator.validate(notification, function (err, message) {
   done(err);
});

It looks like an issue is in the "encoding" parameter when the message is converted from binary to string when is sent through HTTP. The strange thing is that if I see diamonds the Amazon should also see and encode diamonds "�����".

@Kandalay: The notification message that is sent to HTTP is the same string that is used to create a signature? The signature is created from the string or, directly from the binary data? Do you also see diamonds when parse EML headers?

MarkBB
답변함 5달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인