Validation of the SES message signature fails because of the diamonds in the Message field

0

We have an Inbound SES rule that sends SNS notifications. Sometimes arrived SES notification contains illegal unicode characters in the Message field that appears as diamonds (the Message field contains parsed EML headers). In this case the SNS signature fails.

How is it possible? The SNS signature should be created by AWS from the same message that is sent to SNS queue, isn't it? Maybe, AWS first of all creates signature from binary data that is later sent to S3, and after that sends already broken JSON string with diamonds to SNS?

P.S. I can provide SNS MessageId and S3 topicArn/objectKey per request.

2 個答案
0

Hello,

Please refer the below Github issue which talks about the similar issue :

[+] https://github.com/aws/aws-sdk-java/issues/2340

As suggested in the above Github issue comments, kindly try providing an explicit Charset for the signature checker.

Moving ahead, if the issue still persists, we would require further details from your end which are non-public information, like your SNS message ids/request ids in order to investigate this issue further. Hence, please open a support case with AWS Premium Support using the below link and kindly share the necessary details so that we can further investigate this issue and find the root cause.

[+] AWS Premium Support: https://aws.amazon.com/premiumsupport/

[+] Create a case: https://support.console.aws.amazon.com/support/home#/case/create

AWS
支援工程師
已回答 5 個月前
0

I tried to validate it with an official AWS SNS validator and it still doesn't work:

let MessageValidator = require('sns-validator');
let validator = new MessageValidator();
validator.encoding = 'utf8';
let notification = require('../notification.json');
validator.validate(notification, function (err, message) {
   done(err);
});

It looks like an issue is in the "encoding" parameter when the message is converted from binary to string when is sent through HTTP. The strange thing is that if I see diamonds the Amazon should also see and encode diamonds "�����".

@Kandalay: The notification message that is sent to HTTP is the same string that is used to create a signature? The signature is created from the string or, directly from the binary data? Do you also see diamonds when parse EML headers?

MarkBB
已回答 5 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南