fix(s3s/sigv4): validate POST policy fields match sigV4 conditions

Per AWS SigV4 spec, the signed POST policy must contain eq conditions
for x-amz-date, x-amz-credential, and x-amz-algorithm that match
the submitted form fields exactly. This closes a replay-window bypass
where the clock-skew check trusted the unsigned form field x-amz-date
while the signing key only bound YYYYMMDD.

- Add PostPolicy::eq_condition_value helper
- Validate policy conditions in v4_check_post_signature, before
  clock-skew check and signature verification
- Update test fixtures to include required eq conditions

Author: Nugine

crates/s3s/src/ops/signature.rs

@@ -5,6 +5,7 @@ use crate::error::*;
 use crate::http;
 use crate::http::{AwsChunkedStream, Body, Multipart, MultipartLimits};
 use crate::http::{OrderedHeaders, OrderedQs};
+use crate::post_policy::PostPolicy;
 use crate::protocol::TrailingHeaders;
 use crate::sig_v2;
 use crate::sig_v2::{AuthorizationV2, PostSignatureV2, PresignedUrlV2};
@@ -267,6 +268,29 @@ impl SignatureContext<'_> {
 
         let amz_date = AmzDate::parse(info.x_amz_date).map_err(|_| invalid_request!("invalid field: x-amz-date"))?;
 
+        // Per AWS SigV4 spec, the signed POST policy must contain eq conditions
+        // for x-amz-date, x-amz-credential, and x-amz-algorithm that match the
+        // submitted form fields exactly.
+        {
+            let policy = PostPolicy::from_base64(info.policy)
+                .map_err(|e| s3_error!(e, InvalidPolicyDocument))?;
+
+            let policy_date = policy.eq_condition_value("x-amz-date");
+            if policy_date != Some(info.x_amz_date) {
+                return Err(s3_error!(InvalidPolicyDocument, "x-amz-date does not match policy"));
+            }
+
+            let policy_credential = policy.eq_condition_value("x-amz-credential");
+            if policy_credential != Some(info.x_amz_credential) {
+                return Err(s3_error!(InvalidPolicyDocument, "x-amz-credential does not match policy"));
+            }
+
+            let policy_algo = policy.eq_condition_value("x-amz-algorithm");
+            if policy_algo != Some(info.x_amz_algorithm) {
+                return Err(s3_error!(InvalidPolicyDocument, "x-amz-algorithm does not match policy"));
+            }
+        }
+
         // Per AWS SigV4 spec, the credential scope date must match the x-amz-date date.
         if credential.date != amz_date.fmt_date().as_str() {
             let mut err = S3Error::new(S3ErrorCode::SignatureDoesNotMatch);
@@ -1586,7 +1610,15 @@ file content\r\n\
         let request_time = time::OffsetDateTime::now_utc() - skew - time::Duration::minutes(1);
         let amz_date_str = fmt_current_amz_date(request_time);
         let amz_date = AmzDate::parse(&amz_date_str).unwrap();
-        let policy_b64 = base64_simd::STANDARD.encode_to_string("{}");
+
+        // Construct a proper POST policy JSON with the required eq conditions
+        let policy_json = format!(
+            r#"{{"expiration":"2099-01-01T00:00:00Z","conditions":[{{"x-amz-date":"{amz_date}"}},{{"x-amz-credential":"{access_key}/{date}/us-east-1/s3/aws4_request"}},{{"x-amz-algorithm":"AWS4-HMAC-SHA256"}}]}}"#,
+            amz_date = amz_date_str,
+            access_key = access_key,
+            date = amz_date.fmt_date(),
+        );
+        let policy_b64 = base64_simd::STANDARD.encode_to_string(&policy_json);
         let signature = sig_v4::calculate_signature(&policy_b64, &secret_key, &amz_date, "us-east-1", "s3");
         let boundary = "boundary123";
         let body = format!(

crates/s3s/src/ops/tests.rs

@@ -662,26 +662,45 @@ mod post_policy_test_helpers {
         )
     }
 
-    /// Build a POST object request with a policy
+    /// Augment a test POST policy JSON with the required `SigV4` eq conditions
+    /// (`x-amz-date`, `x-amz-credential`, `x-amz-algorithm`) so the request
+    /// passes the verifier's policy-field-matching checks.
+    fn augment_post_policy_for_test(policy_json: &str, amz_date: &str, credential: &str, algorithm: &str) -> String {
+        let mut policy: serde_json::Value = serde_json::from_str(policy_json).expect("invalid test policy JSON");
+        let conditions = policy["conditions"]
+            .as_array_mut()
+            .expect("policy must have a conditions array");
+        conditions.push(serde_json::json!({"x-amz-date": amz_date}));
+        conditions.push(serde_json::json!({"x-amz-credential": credential}));
+        conditions.push(serde_json::json!({"x-amz-algorithm": algorithm}));
+        policy.to_string()
+    }
+
+    /// Build a POST object request with a policy.
+    ///
+    /// The provided `policy_json` is augmented with the required `SigV4` POST
+    /// policy eq conditions (`x-amz-date`, `x-amz-credential`, `x-amz-algorithm`)
+    /// so the request passes the verifier's policy-field-matching checks.
     pub fn build_post_object_request(
         policy_json: &str,
         file_content: &str,
         secret_key: &SecretKey,
         with_content_type: bool,
     ) -> Request {
-        let policy_b64 = base64_simd::STANDARD.encode_to_string(policy_json);
-
         let boundary = "------------------------test12345678";
         let bucket = "test-bucket";
         let key = "test-key";
         let amz_date = sig_v4::AmzDate::parse("20250101T000000Z").unwrap();
+        let amz_date_str = amz_date.fmt_iso8601();
         let region = "us-east-1";
         let service = "s3";
         let content_type = "text/plain";
         let algorithm = "AWS4-HMAC-SHA256";
         let credential = "AKIAIOSFODNN7EXAMPLE/20250101/us-east-1/s3/aws4_request";
+
+        let policy_json = augment_post_policy_for_test(policy_json, amz_date_str.as_str(), credential, algorithm);
+        let policy_b64 = base64_simd::STANDARD.encode_to_string(&policy_json);
         let signature = sig_v4::calculate_signature(&policy_b64, secret_key, &amz_date, region, service);
-        let amz_date_str = amz_date.fmt_iso8601();
 
         let fields = {
             let mut f = vec![
@@ -721,25 +740,29 @@ mod post_policy_test_helpers {
     /// This ensures that `aggregate_file_stream_limited` returns a `Vec<Bytes>`
     /// with multiple entries, so tests can distinguish between
     /// `vec_bytes.len()` (chunk count) and the total byte count.
+    ///
+    /// The provided `policy_json` is augmented with the required `SigV4` POST
+    /// policy eq conditions so the request passes the verifier's checks.
     pub fn build_post_object_request_chunked(
         policy_json: &str,
         file_content: &str,
         secret_key: &SecretKey,
         chunk_size: usize,
     ) -> Request {
-        let policy_b64 = base64_simd::STANDARD.encode_to_string(policy_json);
-
         let boundary = "------------------------test12345678";
         let bucket = "test-bucket";
         let key = "test-key";
         let amz_date = sig_v4::AmzDate::parse("20250101T000000Z").unwrap();
+        let amz_date_str = amz_date.fmt_iso8601();
         let region = "us-east-1";
         let service = "s3";
         let content_type = "text/plain";
         let algorithm = "AWS4-HMAC-SHA256";
         let credential = "AKIAIOSFODNN7EXAMPLE/20250101/us-east-1/s3/aws4_request";
+
+        let policy_json = augment_post_policy_for_test(policy_json, amz_date_str.as_str(), credential, algorithm);
+        let policy_b64 = base64_simd::STANDARD.encode_to_string(&policy_json);
         let signature = sig_v4::calculate_signature(&policy_b64, secret_key, &amz_date, region, service);
-        let amz_date_str = amz_date.fmt_iso8601();
 
         let body = build_multipart_fields(
             &[

crates/s3s/src/post_policy.rs

@@ -257,6 +257,15 @@ impl PostPolicy {
         }
         None
     }
+
+    /// Returns the value of an `eq` condition for the given field, if present.
+    #[must_use]
+    pub(crate) fn eq_condition_value(&self, field: &str) -> Option<&str> {
+        self.conditions.iter().find_map(|c| match c {
+            PostPolicyCondition::Eq { field: f, value } if f == field => Some(value.as_str()),
+            _ => None,
+        })
+    }
 }
 
 /// Raw POST policy for deserialization