[Bug]: SigV4 signature mismatch in S3 pagination due to unsafe characters in continuation-token (' and $)

[akapa12386]

Real Outcome

When paginating S3 List requests, if the continuation-token contains specific special characters such as ' or $, SigV4 signature calculation fails, resulting in a 403 Forbidden error from the S3 provider (tested on Bitiful S3 endpoint: s3.bitiful.net).

Root Cause Analysis

The issue originates from the character set used in anchor ID generation:

// asymmetric-storage.ts (line 275)
const SAFE_81 = " !$'(),-.0123456789;=@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{}";

SAFE_81 includes characters like ' (single quote) and $ (dollar sign). While these characters may be safe for local filenames, they cause inconsistencies when serialized as URL query parameters in S3 list continuation tokens:

1. Request Construction: continuation-token=Iv'R$~example.md
2. URL Encoding: Sent with percentage encoding (Iv%27R%24%7E...).
3. SigV4 Signing: Canonicalization of query parameters produces a signature based on encoding rules that differ from the server's expected canonical query string.
4. Result: Signature mismatch leads to HTTP 403 Forbidden.

Log Evidence & Test Matrix

From S3 server logs, pagination succeeds for all standard tokens and consistently fails only when special characters (' or $) are present:

Continuation Token	Anchor ID	Result
H9FJe~smm-to-md.js	H9FJe	✅ 200 OK
GkLCz~11+-+Breaker...	GkLCz	✅ 200 OK
GI3Ne~局部截取...	GI3Ne	✅ 200 OK
Fl3f~185.png	Fl3f	✅ 200 OK
Iv'R$~不计入最低价工具.md	Iv'R$	❌ 403 Forbidden

Expected Outcome

Anchor IDs or continuation token generation should restrict characters to RFC 3986 unreserved characters ([A-Za-z0-9-_.~]), or

SigV4 canonical query string encoding should strictly conform to standard S3 URI encoding requirements to prevent signature mismatches across strict S3-compatible providers.

Backend

aa

Steps to Reproduce

aa

Support Log

Generated at: 2026-08-09 00:30:38
Plugin version: 3.0.2
Obsidian API version: 1.13.4
Operating system: Windows

Trigger: manual
Started at: 2026-08-09 00:27:53
Ended at: 2026-08-09 00:27:56
Duration: 2.83 s
Outcome: failed
Logs:
INFO - Sync triggered by manual started.
ERROR - Sync ended with error: Request failed, status 403.

General logs:
00:27:39 - INFO - Module i18n-zh loaded.
00:27:39 - INFO - Module s3 loaded.
00:27:39 - INFO - Discovered 7 module(s) from 1 source(s).

Issue Policies

• I agree to follow this project's issue policies and confirm:

[hesprs]

Fixed in S3 module 0.0.2.