rgw: verify Content-MD5 is a valid base64 value

Fixes: #10333
Signed-off-by: Javier M. Mellid <jmunhoz@igalia.com>

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 1f195b5925f062cdbf1edcb9cd5ff1b1154def82..af2de978b3175459dee4a624023bd6c2730d28ae 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -2765,6 +2765,10 @@ int RGW_Auth_S3::authorize_v4_complete(RGWRados *store, struct req_state *s, str
 
 }
 
+static inline bool is_base64_for_content_md5(unsigned char c) {
+  return (isalnum(c) || isspace(c) || (c == '+') || (c == '/') || (c == '='));
+}
+
 /*
  * handle v4 signatures (rados auth only)
  */
@@ -3007,6 +3011,14 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
       dout(10) << "error getting env var" << dendl;
       return -EINVAL;
     }
+    if (token_env == "HTTP_CONTENT_MD5") {
+      for (const char *p = t; *p; p++) {
+       if (!is_base64_for_content_md5(*p)) {
+         dout(0) << "NOTICE: bad content-md5 provided (not base64), aborting request p=" << *p << " " << (int)*p << dendl;
+         return -EPERM;
+       }
+      }
+    }
     string token_value = string(t);
     canonical_hdrs_map[token] = rgw_trim_whitespace(token_value);
   }