Validation of the SES message signature fails because of the diamonds in the Message field

0

We have an Inbound SES rule that sends SNS notifications. Sometimes arrived SES notification contains illegal unicode characters in the Message field that appears as diamonds (the Message field contains parsed EML headers). In this case the SNS signature fails.

How is it possible? The SNS signature should be created by AWS from the same message that is sent to SNS queue, isn't it? Maybe, AWS first of all creates signature from binary data that is later sent to S3, and after that sends already broken JSON string with diamonds to SNS?

P.S. I can provide SNS MessageId and S3 topicArn/objectKey per request.

2 Answers
0

Hello,

Please refer the below Github issue which talks about the similar issue :

[+] https://github.com/aws/aws-sdk-java/issues/2340

As suggested in the above Github issue comments, kindly try providing an explicit Charset for the signature checker.

Moving ahead, if the issue still persists, we would require further details from your end which are non-public information, like your SNS message ids/request ids in order to investigate this issue further. Hence, please open a support case with AWS Premium Support using the below link and kindly share the necessary details so that we can further investigate this issue and find the root cause.

[+] AWS Premium Support: https://aws.amazon.com/premiumsupport/

[+] Create a case: https://support.console.aws.amazon.com/support/home#/case/create

AWS
SUPPORT ENGINEER
answered 5 months ago
0

I tried to validate it with an official AWS SNS validator and it still doesn't work:

let MessageValidator = require('sns-validator');
let validator = new MessageValidator();
validator.encoding = 'utf8';
let notification = require('../notification.json');
validator.validate(notification, function (err, message) {
   done(err);
});

It looks like an issue is in the "encoding" parameter when the message is converted from binary to string when is sent through HTTP. The strange thing is that if I see diamonds the Amazon should also see and encode diamonds "�����".

@Kandalay: The notification message that is sent to HTTP is the same string that is used to create a signature? The signature is created from the string or, directly from the binary data? Do you also see diamonds when parse EML headers?

MarkBB
answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions