Problem

encodePath treats + the same as space, writing %20 for both:

// Special handling for space and plus sign
if (char == ' '.codeUnitAt(0) || char == '+'.codeUnitAt(0)) {
  result.write('%20');
  continue;
}

AWS SigV4 requires + in a URI path to be percent-encoded as %2B; %20 is correct only for space. This mismatch causes a signature verification failure (HTTP 403) for any S3 object whose key contains a literal + — for example Movie Title HDR10+ BluRay.mkv. The canonical request path used for signing diverges from what S3 computes on its side, so the signatures never match.

Both statObject (existence checks) and presigned GET URLs are affected because both go through getCanonicalRequest → encodePath.

Fix

Remove + from the space special-case so it falls through to the generic percent-encoding block, which correctly emits %2B:

if (char == ' '.codeUnitAt(0)) {
  result.write('%20');
  continue;
}

References

• AWS SigV4 canonical URI spec: "URI encode every byte … The space character is a reserved character and must be encoded as %20 (and not as +)"
• RFC 3986 §2.2/§2.3: + is a sub-delimiter and must be percent-encoded when it appears literally in a path component.