Repository navigation
Accept a blob SAS scoped to one blob version (sr=bv) - #2905
Open
Gavin Thompson (gavin-thompson-postman) wants to merge 1 commit into
Open
Gavin Thompson (gavin-thompson-postman) wants to merge 1 commit into
Gavin Thompson (gavin-thompson-postman) wants to merge 1 commit into
Conversation
Azure Storage accepts a service SAS whose signed resource is a blob version, which the SDKs generate for a version client: sr=bv, with the version id signed in the field a snapshot SAS signs its snapshot time in. Azurite's blob SAS authenticator skipped such a SAS as having an invalid signed resource type, so reading a version through one, or using one as the source of Put Blob From URL, failed with 403 AuthorizationFailure (CannotVerifyCopySource for the copy). Accept bv alongside b and bs: judge its permissions as a blob's, sign over the blob name, and take the signed version from the versionid the request names, so a SAS for one version does not read another. Co-Authored-By: Claude <noreply@anthropic.com>
Copilot started reviewing on behalf of
Gavin Thompson (gavin-thompson-postman)
November 12, 2026 16:10
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical version-SAS flaws leave user-delegation signatures unbound to the version, allow authorization to escape to the base blob, and check the wrong permission for version deletion.
3 open issues
What changed in this PR
This PR extends Azurite’s blob-versioning support to accept service SAS tokens scoped to a single version (sr=bv), enabling authenticated reads and Put Blob From URL copies of previous versions.
Changes:
- Recognizes
bvand incorporates the blob name and requested version into service SAS validation. - Adds tests for version-scoped reads, copies, and rejection of a different version.
- Documents the user-visible behavior in the upcoming-release changelog.
Validation here was limited to code inspection; no builds or tests were run.
| File | Description |
|---|---|
tests/blob/apis/blockblob.versioning.test.ts |
Adds version-SAS read, copy, and cross-version rejection tests. |
src/blob/authentication/IBlobSASSignatureValues.ts |
Includes the blob name for bv in selected signature formats. |
src/blob/authentication/BlobSASResourceType.ts |
Defines the bv signed resource type. |
src/blob/authentication/BlobSASAuthenticator.ts |
Accepts bv, selects blob permissions, and extracts the signed version. |
ChangeLog.md |
Announces version-scoped service SAS support. |
Review effort: Balanced
Comment on lines
+108
to
+109
| resource !== BlobSASResourceType.BlobSnapshot && | ||
| resource !== BlobSASResourceType.BlobVersion |
Comment on lines
+394
to
395
| resource === BlobSASResourceType.BlobVersion | ||
| ? OPERATION_BLOB_SAS_BLOB_PERMISSIONS.get(operation) |
Comment on lines
+393
to
395
| resource === BlobSASResourceType.Blob || | ||
| resource === BlobSASResourceType.BlobVersion | ||
| ? OPERATION_BLOB_SAS_BLOB_PERMISSIONS.get(operation) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Azure Storage accepts a service SAS whose signed resource is one blob version (
sr=bv). The SDKs generate one for a version client, e.g.blockBlobClient.withVersion(id).generateSasUrl(...), and it signs the version id in the field a snapshot SAS signs its snapshot time in.Azurite's
BlobSASAuthenticatorskipped such a SAS as having an invalid signed resource type. So with blob versioning on (#2735), these failed with 403:AuthorizationFailure);CannotVerifyCopySource).The same requests succeed against a real versioned storage account.
This accepts
bvalongsidebandbs:versionid, so a SAS for one version can't read another.New tests in
blockblob.versioning.test.ts:The first two fail without the change. The SAS and versioning suites pass (222 tests), and lint is clean.
Found while running S3Proxy's azureblob backend against Azurite with versioning on (gaul/s3proxy#1236). S3Proxy signs the copy source this way when an S3 copy names a source version.
Generated with Claude Code