fix: reject unknown response-* query parameters in GetObject and HeadObject

getobject and headobject silently ignored any response-* query parameter outside the six overridable headers. they now return 400 InvalidArgument naming the parameter and its value, like s3, and the rest tests skipped for this issue are enabled.

Fixes #2075

s3api/controllers/object-get.go

@@ -451,6 +451,14 @@ func (c S3ApiController) GetObject(ctx fiber.Ctx) (*Response, error) {
 	isPublicBucketRequest := utils.ContextKeyPublicBucket.IsSet(ctx)
 	utils.ContextKeySkipResBodyLog.Set(ctx, true)
 
+	if err := utils.ValidateResponseOverrides(ctx); err != nil {
+		return &Response{
+			MetaOpts: &MetaOptions{
+				BucketOwner: parsedAcl.Owner,
+			},
+		}, err
+	}
+
 	// Validate that response override parameters are not used with anonymous requests
 	if hasResponseOverrides && isPublicBucketRequest {
 		return &Response{

s3api/controllers/object-get_test.go

@@ -770,6 +770,23 @@ func TestS3ApiController_GetObject(t *testing.T) {
 				err: s3err.GetInvalidArgumentErr(s3err.InvalidArgEmptyVersionId, ""),
 			},
 		},
+		{
+			name: "invalid response override query param",
+			input: testInput{
+				locals: defaultLocals,
+				queries: map[string]string{
+					"response-invalid": "dummy",
+				},
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{
+						BucketOwner: "root",
+					},
+				},
+				err: s3err.GetInvalidArgResponseOverride("response-invalid", "dummy"),
+			},
+		},
 		{
 			name: "verify access fails",
 			input: testInput{

s3api/controllers/object-head.go

@@ -61,6 +61,14 @@ func (c S3ApiController) HeadObject(ctx fiber.Ctx) (*Response, error) {
 		}
 	}
 
+	if err := utils.ValidateResponseOverrides(ctx); err != nil {
+		return &Response{
+			MetaOpts: &MetaOptions{
+				BucketOwner: parsedAcl.Owner,
+			},
+		}, err
+	}
+
 	// Validate that response override parameters are not used with anonymous requests
 	if hasResponseOverrides && isPublicBucket {
 		debuglogger.Logf("anonymous access is denied with response override params")

s3api/controllers/object-head_test.go

@@ -56,6 +56,23 @@ func TestS3ApiController_HeadObject(t *testing.T) {
 				err: s3err.GetInvalidArgumentErr(s3err.InvalidArgEmptyVersionId, ""),
 			},
 		},
+		{
+			name: "invalid response override query param",
+			input: testInput{
+				locals: defaultLocals,
+				queries: map[string]string{
+					"response-invalid": "dummy",
+				},
+			},
+			output: testOutput{
+				response: &Response{
+					MetaOpts: &MetaOptions{
+						BucketOwner: "root",
+					},
+				},
+				err: s3err.GetInvalidArgResponseOverride("response-invalid", "dummy"),
+			},
+		},
 		{
 			name: "verify access fails",
 			input: testInput{