From: Casey Bodley <cbodley@redhat.com>
Date: Fri, 26 Jan 2024 14:53:30 +0000 (-0500)
Subject: rgw/rest: fix url decode of post params for iam/sts/sns
X-Git-Tag: testing/wip-pdonnell-testing-20240430.123648-reef-debug~151^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=55a5fef21964c7fa1c059f6bdc35090af4fccafc;p=ceph-ci.git

rgw/rest: fix url decode of post params for iam/sts/sns

add the `in_query=true` argument to `url_decode()` to replace '+' with ' '

Fixes: https://tracker.ceph.com/issues/64189

Signed-off-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit 4bdc5d18dd68b95c6ccd4c0e77a1bd04ad86dbb8)

Conflicts:
	src/rgw/rgw_rest_pubsub.cc no topic policy or SetTopicAttributes
---

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 8c9f535afc2..7b27af8634a 100644
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -5192,8 +5192,9 @@ void parse_post_action(const std::string& post_body, req_state* s)
           if (boost::starts_with(key, "Attributes.")) {
             update_attribute_map(t, map);
           } else {
+            constexpr bool in_query = true; // replace '+' with ' '
             s->info.args.append(t.substr(0, pos),
-                              url_decode(t.substr(pos+1, t.size() -1)));
+                              url_decode(t.substr(pos+1, t.size() -1), in_query));
           }
         }
       }
diff --git a/src/rgw/rgw_rest_user_policy.cc b/src/rgw/rgw_rest_user_policy.cc
index 2e300468b95..2995a43adbf 100644
--- a/src/rgw/rgw_rest_user_policy.cc
+++ b/src/rgw/rgw_rest_user_policy.cc
@@ -91,9 +91,9 @@ uint64_t RGWPutUserPolicy::get_op()
 
 int RGWPutUserPolicy::get_params()
 {
-  policy_name = url_decode(s->info.args.get("PolicyName"), true);
-  user_name = url_decode(s->info.args.get("UserName"), true);
-  policy = url_decode(s->info.args.get("PolicyDocument"), true);
+  policy_name = s->info.args.get("PolicyName");
+  user_name = s->info.args.get("UserName");
+  policy = s->info.args.get("PolicyDocument");
 
   if (policy_name.empty() || user_name.empty() || policy.empty()) {
     ldpp_dout(this, 20) << "ERROR: one of policy name, user name or policy document is empty"