Skip to content

S3 model does not validate empty bucket names (leads to panic in SDK) #3378

@hanagantig

Description

@hanagantig

Acknowledgements

Describe the bug

The S3 service model does not validate empty bucket names, which allows invalid input ("") to pass through SDK validation layers.

This can lead to runtime issues in SDK logic that assumes a non-empty bucket name. For example, in the Go SDK, this results in a panic in dnsCompatibleBucketName due to direct string indexing (bucket[0]).

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

  • Empty string bucket is rejected early with clear errors
  • No reliance on downstream defensive checks
  • Invalid input should result in a proper validation error instead of panic

Current Behavior

Currently, the generated validation only checks whether the Bucket field is nil, but does not reject empty string values:

  • Bucket == nil → validation error
  • Bucket == "" → passes validation (unexpected)

This allows invalid input to propagate into downstream logic. This results in a panic in dnsCompatibleBucketName due to direct string indexing (bucket[0]).

func dnsCompatibleBucketName(bucket string) bool {
	if strings.Contains(bucket, "..") {
		return false
	}

	// checks for `^[a-z0-9][a-z0-9\.\-]{1,61}[a-z0-9]$` domain mapping
	if !((bucket[0] > 96 && bucket[0] < 123) || (bucket[0] > 47 && bucket[0] < 58)) {
		return false
	}

Reproduction Steps

Calling PutObject with an empty bucket name:

_, err := client.PutObject(ctx, &s3.PutObjectInput{
    Bucket: aws.String(""),
    Key:    aws.String("test.txt"),
    Body:   strings.NewReader("data"),
})

Possible Solution

I raised a PR to address this issue in dnsCompatibleBucketName by safely handling empty input and preventing the panic. However, I guess this still needs to be addressed at the S3 service model level to ensure proper validation across all SDKs.

Additional Information/Context

No response

AWS Go SDK V2 Module Versions Used

github.com/aws/aws-sdk-go-v2 v1.41.5
github.com/aws/aws-sdk-go-v2/config v1.32.14
github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0

Compiler and Version used

go1.24.0 darwin/arm64

Operating System and version

macOS Tahoe Version 26.3

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThis issue is a bug.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions