mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-16 12:16:36 +00:00
Chris LuandGitHub
c46526822b
* s3: embedded IAM inline policy honors prefix-scoped resources getActions stripped the trailing wildcard from a resource like arn:aws:s3:::bucket/prefix/*, producing a non-wildcard action (Write:bucket/prefix) that CanDo only ever matched at bucket level, so PutObject under the prefix was denied. Preserve the object path with its wildcard (Write:bucket/prefix/*) to match objects under the prefix, matching the standalone iamapi behavior. * s3: prune bucket-confined wildcard actions on bucket delete actionScopedToBucket treated any wildcard as multi-bucket, so a prefix-scoped action like Write:bucket/prefix/* survived deletion of its own bucket and could re-grant access if the bucket was recreated. Scope the wildcard check to the bucket segment only: a wildcard in the object path stays scoped to its bucket, while one in the bucket segment does not.
27 lines
697 B
Go
27 lines
697 B
Go
package s3api
|
|
|
|
import "testing"
|
|
|
|
func TestActionScopedToBucket(t *testing.T) {
|
|
cases := []struct {
|
|
action string
|
|
bucket string
|
|
want bool
|
|
}{
|
|
{"Read:bucket", "bucket", true},
|
|
{"Write:bucket/prefix", "bucket", true},
|
|
{"Write:bucket/prefix/*", "bucket", true},
|
|
{"Write:bucket/*", "bucket", true},
|
|
{"Read:other/prefix/*", "bucket", false},
|
|
{"Write:*", "bucket", false},
|
|
{"Write:buck*/x", "bucket", false},
|
|
{"Write:bucketother", "bucket", false},
|
|
{"Admin", "bucket", false},
|
|
}
|
|
for _, c := range cases {
|
|
if got := actionScopedToBucket(c.action, c.bucket); got != c.want {
|
|
t.Errorf("actionScopedToBucket(%q, %q) = %v, want %v", c.action, c.bucket, got, c.want)
|
|
}
|
|
}
|
|
}
|