mirrors/minio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: merge duplicate keys in post policy (#11843)

Browse Source 
some SDKs might incorrectly send duplicate
entries for keys such as "conditions", Go
stdlib unmarshal for JSON does not support
duplicate keys - instead skips the first
duplicate and only preserves the last entry.

This can lead to issues where a policy JSON
while being valid might not properly apply
the required conditions, allowing situations
where POST policy JSON would end up allowing
uploads to unauthorized buckets and paths.

This PR fixes this properly.
This commit is contained in:
Harshavardhana
2021-03-20 22:16:30 -07:00
committed by GitHub
parent 23b03dadb8
commit 726d80dbb7
4 changed files with 78 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
go.mod
View File

@@ -74,7 +74,7 @@ require (
github.com/shirou/gopsutil/v3 v3.21.1
github.com/spaolacci/murmur3 v1.1.0 // indirect
github.com/streadway/amqp v1.0.0
github.com/tidwall/gjson v1.6.7
github.com/tidwall/gjson v1.6.8
github.com/tidwall/sjson v1.0.4
github.com/tinylib/msgp v1.1.3
github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a