Implement Put Block From URL by gaul · Pull Request #2681 · Azure/Azurite

gaul · 2026-07-25T22:38:31Z

Stage the block by fetching the copy source over loopback so that SAS authentication, x-ms-source-range, and the x-ms-source-if-* conditions are enforced by the existing download path, then persist it through the same extent flow as Put Block. Only sources on the same Azurite instance are supported, matching copyFromURL. The response carries the MD5 of the staged content and source condition failures return 412 SourceConditionNotMet as on the real service.

Validated with the blockblob test suite and end to end with S3Proxy's native multipart part copy, which previously fell back to streamed emulation on Azurite's 501.

Copilot

Pull request overview

Adds support for Block Blob Stage Block From URL (Put Block From URL) in Azurite by downloading the source content via the existing blob download path (so SAS/range/source conditions can be applied) and persisting the staged data through the normal extent + uncommitted-block flow.

Changes:

Implements stageBlockFromURL in BlockBlobHandler by fetching the source via HTTP and staging it as an uncommitted block.
Introduces a new SourceConditionNotMet (412) storage error for unmet source conditional headers during staging.
Expands the block blob API test suite with stageBlockFromURL coverage (range, full copy, unmet condition, missing source).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tests/blob/apis/blockblob.test.ts	Adds tests validating stageBlockFromURL behavior (ranges, full copy, 412 on unmet source condition, 404 on missing source).
src/blob/handlers/BlockBlobHandler.ts	Implements the stageBlockFromURL handler: validates input, downloads source data, persists it, and returns MD5.
src/blob/errors/StorageErrorFactory.ts	Adds `getSourceConditionNotMet()` (412) error factory helper.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

gaul · 2026-07-25T22:59:20Z

+    const blobCtx = new BlobStorageContext(context);
+    const accountName = blobCtx.account!;
+    const containerName = blobCtx.container!;
+    const blobName = blobCtx.blob!;
+    const date = blobCtx.startTime!;
+


gaul · 2026-07-25T22:59:05Z

+    const sourceConditions = options.sourceModifiedAccessConditions || {};
+    if (sourceConditions.sourceIfMatch !== undefined) {
+      headers["if-match"] = sourceConditions.sourceIfMatch;
+    }
+    if (sourceConditions.sourceIfNoneMatch !== undefined) {
+      headers["if-none-match"] = sourceConditions.sourceIfNoneMatch;
+    }
+    if (sourceConditions.sourceIfModifiedSince !== undefined) {
+      headers["if-modified-since"] = new Date(
+        sourceConditions.sourceIfModifiedSince
+      ).toUTCString();
+    }
+    if (sourceConditions.sourceIfUnmodifiedSince !== undefined) {
+      headers["if-unmodified-since"] = new Date(
+        sourceConditions.sourceIfUnmodifiedSince
+      ).toUTCString();
+    }


gaul · 2026-07-25T22:59:08Z

+    const currentServer = blobCtx.request!.getHeader("Host") || "";
+    if (currentServer !== url.host) {
+      this.logger.error(
+        `BlockBlobHandler:stageBlockFromURL() Source ${url} is not on the same Azurite instance as target account ${accountName}`,
+        context.contextId
+      );
+      throw StorageErrorFactory.getCannotVerifyCopySource(
+        context.contextId!,
+        404,
+        "The specified resource does not exist"
+      );
+    }


gaul · 2026-07-25T22:52:07Z

Addressed the review in aa00b52:

Content-Length — the handler now rejects a nonzero Content-Length with 400 InvalidHeaderValue, since Put Block From URL carries no request body, with a test issuing a raw request with a body.
x-ms-source-if-tags — deliberately not forwarded, with a comment in the handler explaining why: unlike the Copy Blob operations, Put Block From URL has no source tags condition. The field appears in the shared SourceModifiedAccessConditions TypeScript interface, but blockBlobStageBlockFromURLOperationSpec has no Parameters.sourceIfTags, matching the service REST contract, so the deserializer never populates it for this operation.
SSRF via Host — the loopback fetch is no longer built from the caller-supplied URL. The handler takes the actual bound address and port from the request's connection socket and fetches scheme://127.0.0.1:<localPort> plus only the caller's path and query, so a forged Host header can no longer point the fetch at an arbitrary URL. The same-instance Host comparison remains for the 404-on-foreign-source behavior that copyFromURL has.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

gaul · 2026-07-25T22:56:49Z

+    const scheme = "encrypted" in rawRequest.socket ? "https" : "http";
+    const pinnedUrl =
+      `${scheme}://127.0.0.1:${rawRequest.socket.localPort}` +
+      `${url.pathname}${url.search}`;


gaul · 2026-07-25T22:56:45Z

+    if (options.sourceRange !== undefined) {
+      headers.range = options.sourceRange;
+    }


gaul · 2026-07-25T22:59:39Z

Second round addressed in 381b126: the source fetch now pins to the local address the request arrived on (bracketing IPv6 literals) instead of hard-coded 127.0.0.1, so non-loopback --blobHost binds work; and malformed x-ms-source-range values now fail with 400 InvalidHeaderValue up front instead of silently staging the whole source, with tests for both the malformed-range shapes and the reversed-bounds case.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

gaul · 2026-07-25T23:09:28Z

+
+    // Fetch the source range over loopback so that SAS authentication,
+    // range handling, and source conditions reuse the download path.
+    const headers: { [key: string]: string } = {};


gaul · 2026-07-25T23:05:39Z

Addressed in 8847aec: the pinned loopback fetch now sends the original source URL host as the Host header — so product-style sources resolve their account through blobStorageContext.middleware exactly as a direct request would — while the TCP connection stays pinned to the server's bound address. Added an end-to-end test where both the destination request and the copy source use product-style account.localhost URLs.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

gaul · 2026-07-25T23:12:25Z

+    const currentServer = blobCtx.request!.getHeader("Host") || "";
+    if (currentServer !== url.host) {


gaul · 2026-07-25T23:11:28Z

Addressed in e665103: the same-instance comparison now lowercases the client-supplied Host header before comparing against the already-lowercased URL host, with a mixed-case Host regression test.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Stage the block by fetching the copy source over loopback so that SAS authentication, x-ms-source-range, and the x-ms-source-if-* conditions are enforced by the existing download path, then persist it through the same extent flow as Put Block. Only sources on the same Azurite instance are supported, matching copyFromURL. The response carries the MD5 of the staged content and source condition failures return 412 SourceConditionNotMet as on the real service. Validated with the blockblob test suite and end to end with S3Proxy's native multipart part copy, which previously fell back to streamed emulation on Azurite's 501. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gaul · 2026-07-25T23:16:06Z

Squashed after AI review succeeded.

Copilot AI review requested due to automatic review settings July 25, 2026 22:38

Copilot started reviewing on behalf of gaul July 25, 2026 22:39 View session