mirrors/versitygw
1
0
Fork 0
mirror of https://github.com/versity/versitygw.git synced 2026-09-19 22:44:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: v4 auth signature to only use specified signed headers

Browse Source
This commit is contained in:
Ben McClelland
2023-06-06 13:28:17 -07:00
parent 8f27e88198
commit 1717d45664
5 changed files with 31 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
s3api/utils/utils.go
+8 -91
View File
@@ -38,7 +38,7 @@ func GetUserMetaData(headers *fasthttp.RequestHeader) (metadata map[string]strin
return
}
func CreateHttpRequestFromCtx(ctx *fiber.Ctx) (*http.Request, error) {
func CreateHttpRequestFromCtx(ctx *fiber.Ctx, signedHdrs []string) (*http.Request, error) {
req := ctx.Request()
httpReq, err := http.NewRequest(string(req.Header.Method()), req.URI().String(), bytes.NewReader(req.Body()))
@@ -49,14 +49,11 @@ func CreateHttpRequestFromCtx(ctx *fiber.Ctx) (*http.Request, error) {
// Set the request headers
req.Header.VisitAll(func(key, value []byte) {
keyStr := string(key)
if includeHeader(keyStr) {
if includeHeader(keyStr, signedHdrs) {
httpReq.Header.Add(keyStr, string(value))
}
})
// Content-Length header ignored for signing
httpReq.ContentLength = 0
// Set the Host header
httpReq.Host = string(req.Header.Host())
@@ -80,91 +77,11 @@ func SetResponseHeaders(ctx *fiber.Ctx, headers []CustomHeader) {
}
}
func includeHeader(hdr string) bool {
switch {
case strings.EqualFold(hdr, "Cache-Control"):
return true
case strings.EqualFold(hdr, "Content-Disposition"):
return true
case strings.EqualFold(hdr, "Content-Encoding"):
return true
case strings.EqualFold(hdr, "Content-Language"):
return true
case strings.EqualFold(hdr, "Content-Md5"):
return true
case strings.EqualFold(hdr, "Content-Type"):
return true
case strings.EqualFold(hdr, "Expires"):
return true
case strings.EqualFold(hdr, "If-Match"):
return true
case strings.EqualFold(hdr, "If-Modified-Since"):
return true
case strings.EqualFold(hdr, "If-None-Match"):
return true
case strings.EqualFold(hdr, "If-Unmodified-Since"):
return true
case strings.EqualFold(hdr, "Range"):
return true
case strings.EqualFold(hdr, "X-Amz-Acl"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-If-Match"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-If-Modified-Since"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-If-None-Match"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-If-Unmodified-Since"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-Range"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key"):
return true
case strings.EqualFold(hdr, "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5"):
return true
case strings.EqualFold(hdr, "X-Amz-Grant-Full-control"):
return true
case strings.EqualFold(hdr, "X-Amz-Grant-Read"):
return true
case strings.EqualFold(hdr, "X-Amz-Grant-Read-Acp"):
return true
case strings.EqualFold(hdr, "X-Amz-Grant-Write"):
return true
case strings.EqualFold(hdr, "X-Amz-Grant-Write-Acp"):
return true
case strings.EqualFold(hdr, "X-Amz-Metadata-Directive"):
return true
case strings.EqualFold(hdr, "X-Amz-Mfa"):
return true
case strings.EqualFold(hdr, "X-Amz-Request-Payer"):
return true
case strings.EqualFold(hdr, "X-Amz-Server-Side-Encryption"):
return true
case strings.EqualFold(hdr, "X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id"):
return true
case strings.EqualFold(hdr, "X-Amz-Server-Side-Encryption-Customer-Algorithm"):
return true
case strings.EqualFold(hdr, "X-Amz-Server-Side-Encryption-Customer-Key"):
return true
case strings.EqualFold(hdr, "X-Amz-Server-Side-Encryption-Customer-Key-Md5"):
return true
case strings.EqualFold(hdr, "X-Amz-Storage-Class"):
return true
case strings.EqualFold(hdr, "X-Amz-Website-Redirect-Location"):
return true
case strings.EqualFold(hdr, "X-Amz-Content-Sha256"):
return true
case strings.EqualFold(hdr, "X-Amz-Tagging"):
return true
case strings.HasPrefix(hdr, "X-Amz-Object-Lock-"):
return true
case strings.HasPrefix(hdr, "X-Amz-Meta-"):
return true
default:
return false
func includeHeader(hdr string, signedHdrs []string) bool {
for _, shdr := range signedHdrs {
if strings.EqualFold(hdr, shdr) {
return true
}
}
return false
}
s3api/utils/utils_test.go
+1 -1
View File
@@ -56,7 +56,7 @@ func TestCreateHttpRequestFromCtx(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := CreateHttpRequestFromCtx(tt.args.ctx)
got, err := CreateHttpRequestFromCtx(tt.args.ctx, []string{"X-Amz-Mfa"})
if (err != nil) != tt.wantErr {
t.Errorf("CreateHttpRequestFromCtx() error = %v, wantErr %v", err, tt.wantErr)
return