[vedanth-jadhav]

The render farm signs S3 paths and query values with encodeURIComponent, which leaves !'()* unescaped. AWS SigV4 requires those characters to be percent-encoded, so names such as it's (final)!*.mp4, signed response filenames and affected session tokens produce incorrect signatures. Query names also need sorting after encoding.

Use AWS-compatible URI component escaping for object paths, copy-source headers and canonical query names/values, then sort encoded query names. Slash separators remain intact; literal percent signs, spaces, Unicode and plus signs retain their object-key meaning. Signing and presigning share the correction, with no dependency or credential-lifecycle changes.

Validation:

• Nine new tests use independent fixed signatures generated with AWS @smithy/signature-v4 5.7.4, a fixed date, uriEscapePath=false, AWS path escaping and UNSIGNED-PAYLOAD. Both signing forms cover ordinary keys, punctuation, Unicode/query ordering and temporary session credentials; a copy-part test verifies the transmitted source header. Six checks fail on unchanged production source and all pass with this fix.
• Full render-farm suite: 172 passed, zero failures, Bun 1.4.4 on Linux x86_64.
• Scoped strict TypeScript with noUncheckedIndexedAccess, Biome and git diff --check pass.

Reproduce: bun run --cwd apps/render-farm test. Reference SDK packages were used only outside the checkout to produce the vectors; committed tests add no runtime/test dependency. Live AWS credentials/storage were not used. No throughput claim. Rechecked current main and open PRs; browser download authorization #3334 and native upload prefetch #3352 change separate paths.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

The PR fixes AWS URI escaping for S3 signatures without adding dependencies.

• S3 requests now escape object keys and query values the way AWS signs them.

No actionable issues were found. This review checked the code and test cases; it did not rerun the suite or make live AWS requests.

_{Reviews (1) · Last reviewed commit: "fix(render-farm): use AWS URI encoding f..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 26, 2026 9:07am UTC