Redact signature strings properly.

[harshavardhana]

Current code was returning without validating
te origAuth value correctly.

Fixes #705

[krishnasrinivas]

The code in filterSignature is not getting tested. Instead of having two small functions we can have just one filterSignature and not make it a method on Client instead have it as:

// Filter out signature value from Authorization header.                                                                                                                                                           
func filterSignature(h http.Header) {                                                                                                                                                                              
        origAuth := h.Get("Authorization")                                                                                                                                                                         
        if origAuth == "" {                                                                                                                                                                                        
                return                                                                                                                                                                                             
        }                                                                                                                                                                                                          
                                                                                                                                                                                                                   
        if !strings.HasPrefix(origAuth, signV4Algorithm) {                                                                                                                                                         
                // Set a temporary redacted auth                                                                                                                                                                   
                h.Set("Authorization", "AWS **REDACTED**:**REDACTED**")                                                                                                                                            
                return                                                                                                                                                                                             
        }                                                                                                                                                                                                          
                                                                                                                                                                                                                   
        /// Signature V4 authorization header.                                                                                                                                                                     
                                                                                                                                                                                                                   
        // Strip out accessKeyID from:                                                                                                                                                                             
        // Credential=<access-key-id>/<date>/<aws-region>/<aws-service>/aws4_request                                                                                                                               
        newAuth := regCred.ReplaceAllString(origAuth, "Credential=**REDACTED**/")                                                                                                                                  
                                                                                                                                                                                                                   
        // Strip out 256-bit signature from: Signature=<256-bit signature>                                                                                                                                         
        newAuth = regSign.ReplaceAllString(newAuth, "Signature=**REDACTED**")                                                                                                                                      
                                                                                                                                                                                                                   
        // Set a temporary redacted auth                                                                                                                                                                           
        h.Set("Authorization", newAuth)                                                                                                                                                                            
}

This way it is easily unit testable as well.

[harshavardhana]

// Filter out signature value from Authorization header.
func filterSignature(h http.Header) {
origAuth := h.Get("Authorization")
if origAuth == "" {
return
}

    if !strings.HasPrefix(origAuth, signV4Algorithm) {                                                                                                                                                         
            // Set a temporary redacted auth                                                                                                                                                                   
            h.Set("Authorization", "AWS **REDACTED**:**REDACTED**")                                                                                                                                            
            return                                                                                                                                                                                             
    }                                                                                                                                                                                                          
                                                                                                                                                                                                               
    /// Signature V4 authorization header.                                                                                                                                                                     
                                                                                                                                                                                                               
    // Strip out accessKeyID from:                                                                                                                                                                             
    // Credential=<access-key-id>/<date>/<aws-region>/<aws-service>/aws4_request                                                                                                                               
    newAuth := regCred.ReplaceAllString(origAuth, "Credential=**REDACTED**/")                                                                                                                                  
                                                                                                                                                                                                               
    // Strip out 256-bit signature from: Signature=<256-bit signature>                                                                                                                                         
    newAuth = regSign.ReplaceAllString(newAuth, "Signature=**REDACTED**")                                                                                                                                      
                                                                                                                                                                                                               
    // Set a temporary redacted auth                                                                                                                                                                           
    h.Set("Authorization", newAuth)                                                                                                                                                                            

}

Good idea @krishnasrinivas

[nitisht]

Tested, LGTM

This is the updated trace output

---------START-HTTP---------
HEAD /mymusic/ HTTP/1.1
Host: play.minio.io:9000
User-Agent: Minio (linux; amd64) minio-go/2.1.0
Authorization: AWS4-HMAC-SHA256 Credential=**REDACTED**/20170615/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=**REDACTED**
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Date: 20170615T220343Z

HTTP/1.1 200 OK
Connection: close
Accept-Ranges: bytes
Content-Type: text/plain; charset=utf-8
Date: Thu, 15 Jun 2017 22:04:48 GMT
Server: Minio/DEVELOPMENT.2017-06-07T01-11-17Z (linux; amd64)
Vary: Origin
X-Amz-Bucket-Region: us-east-1
X-Amz-Request-Id: 14C86AC92242E542
---------END-HTTP---------