fix: reject unknown response-* query parameters in GetObject and HeadObject

getobject and headobject silently ignored any response-* query parameter outside the six overridable headers. they now return 400 InvalidArgument naming the parameter and its value, like s3, and the rest tests skipped for this issue are enabled.

Fixes #2075

s3api/utils/utils.go

@@ -999,6 +999,36 @@ func ValidateVersionId(ctx fiber.Ctx) error {
 	return nil
 }
 
+// overridableResponseHeaders lists the response-* query parameters that
+// GetObject and HeadObject accept to override response headers.
+var overridableResponseHeaders = map[string]struct{}{
+	"response-cache-control":       {},
+	"response-content-disposition": {},
+	"response-content-encoding":    {},
+	"response-content-language":    {},
+	"response-content-type":        {},
+	"response-expires":             {},
+}
+
+// ValidateResponseOverrides rejects the first response-* query parameter that
+// isn't an overridable response header. S3 answers such a request with 400
+// InvalidArgument instead of ignoring the parameter.
+func ValidateResponseOverrides(ctx fiber.Ctx) error {
+	for key, value := range ctx.Request().URI().QueryArgs().All() {
+		name := string(key)
+		if !strings.HasPrefix(name, "response-") {
+			continue
+		}
+		if _, ok := overridableResponseHeaders[name]; ok {
+			continue
+		}
+		debuglogger.Logf("invalid response override query parameter: %s", name)
+		return s3err.GetInvalidArgResponseOverride(name, string(value))
+	}
+
+	return nil
+}
+
 // ApplyOverride returns the override value if it exists and status is 200, otherwise returns original
 func ApplyOverride(original, override *string) *string {
 	if override != nil {