mirrors/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-09-18 22:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix GetObjectHandler to match HeadObjectHandler pattern

Browse Source 
Add safety check for nil objectEntryForSSE before tag-based policy
evaluation, ensuring tag-based conditions are always evaluated rather
than silently skipped if entry is unexpectedly nil.

Addresses review comment from Copilot.
This commit is contained in:
chrislu
2025-12-09 07:53:31 -08:00
parent 6079a0ae21
commit dbb1e4b182
1 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
weed/s3api/s3api_object_handlers.go
+20 -15
View File
@@ -634,25 +634,30 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
}
entryFetchTime = time.Since(tEntryFetch)
// Safety check: entry must be valid before tag-based policy evaluation
if objectEntryForSSE == nil {
glog.Errorf("GetObjectHandler: objectEntryForSSE is nil for %s/%s (should not happen)", bucket, object)
s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
return
}
// Re-check bucket policy with object entry for tag-based conditions (e.g., s3:ExistingObjectTag)
if objectEntryForSSE != nil {
identityRaw := s3_constants.GetIdentityFromContext(r)
var identity *Identity
if identityRaw != nil {
var ok bool
identity, ok = identityRaw.(*Identity)
if !ok {
glog.Errorf("GetObjectHandler: unexpected identity type in context for %s/%s", bucket, object)
s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
return
}
}
principal := buildPrincipalARN(identity)
if errCode, _ := s3a.checkPolicyWithEntry(r, bucket, object, string(s3_constants.ACTION_READ), principal, objectEntryForSSE.Extended); errCode != s3err.ErrNone {
s3err.WriteErrorResponse(w, r, errCode)
identityRaw := s3_constants.GetIdentityFromContext(r)
var identity *Identity
if identityRaw != nil {
var ok bool
identity, ok = identityRaw.(*Identity)
if !ok {
glog.Errorf("GetObjectHandler: unexpected identity type in context for %s/%s", bucket, object)
s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
return
}
}
principal := buildPrincipalARN(identity)
if errCode, _ := s3a.checkPolicyWithEntry(r, bucket, object, string(s3_constants.ACTION_READ), principal, objectEntryForSSE.Extended); errCode != s3err.ErrNone {
s3err.WriteErrorResponse(w, r, errCode)
return
}
// Check if PartNumber query parameter is present (for multipart GET requests)
partNumberStr := r.URL.Query().Get("partNumber")