]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
rgw: Fix bucket validation against POST policies 53758/head
authorJoshua Baergen <jbaergen@digitalocean.com>
Wed, 17 May 2023 18:17:09 +0000 (12:17 -0600)
committerCasey Bodley <cbodley@redhat.com>
Mon, 2 Oct 2023 19:52:05 +0000 (15:52 -0400)
commit479976538fe8f51edfea597443ba0c0209d3f39f
treef48d910838e21dd184ce7c74999679211634db5d
parenteeb13ac974775bd0cce96a2c687e8bcc2faca43d
rgw: Fix bucket validation against POST policies

It's possible that user could provide a form part as a part of a POST
object upload that uses 'bucket' as a key; in this case, it was
overriding what was being set in the validation env (which is the real
bucket being modified). The result of this is that a user could actually
upload to any bucket accessible by the specified access key by matching
the bucket in the POST policy in said POST form part.

Fix this simply by setting the bucket to the correct value after the
POST form parts are processed, ignoring the form part above if
specified.

Fixes: https://tracker.ceph.com/issues/63004
Signed-off-by: Joshua Baergen <jbaergen@digitalocean.com>
(cherry picked from commit 98bfb71cb38899333deb58dd2562037450fd7fa8)

Conflicts:
src/rgw/rgw_rest_s3.cc get_params() conflict with sse-s3 stuff
src/rgw/rgw_rest_s3.cc