Was just pentesting it, and have some minor result. If you are using S3 browser uploads, make sure parameters you supply to Presign do not contain \n or it can lead to format injection
https://s3.amazonaws.com/doc/s3-developer-guide/RESTAuthenti...Many aws SDK libs don't remove \n for you.
(I hope it wasn't me who broke it lol)
