mirrors/versitygw
1
0
Fork 0
mirror of https://github.com/versity/versitygw.git synced 2026-09-28 18:55:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: reject empty versionId query parameter in object actions

Browse Source 
S3 returns `InvalidArgument` when an object action receives a `versionId` query parameter with no value. The gateway silently treated it as an unversioned request instead.

Added a shared `versionId` validation helper and apply it to the object actions that accept the parameter, so malformed requests are rejected up front rather than reaching the backend.
This commit is contained in:
niksis02
2026-09-10 16:35:05 +04:00
parent be3ec8ba4d
commit 1e0d7b218d
23 changed files with 437 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
s3api/controllers/object-delete.go
+16
View File
@@ -36,6 +36,14 @@ func (c S3ApiController) DeleteObjectTagging(ctx fiber.Ctx) (*Response, error) {
isBucketPublic := utils.ContextKeyPublicBucket.IsSet(ctx)
parsedAcl := utils.ContextKeyParsedAcl.Get(ctx).(auth.ACL)
if err := utils.ValidateVersionId(ctx); err != nil {
return &Response{
MetaOpts: &MetaOptions{
BucketOwner: parsedAcl.Owner,
},
}, err
}
action := auth.DeleteObjectTaggingAction
if versionId != "" {
action = auth.DeleteObjectVersionTaggingAction
@@ -131,6 +139,14 @@ func (c S3ApiController) DeleteObject(ctx fiber.Ctx) (*Response, error) {
isBucketPublic := utils.ContextKeyPublicBucket.IsSet(ctx)
parsedAcl := utils.ContextKeyParsedAcl.Get(ctx).(auth.ACL)
if err := utils.ValidateVersionId(ctx); err != nil {
return &Response{
MetaOpts: &MetaOptions{
BucketOwner: parsedAcl.Owner,
},
}, err
}
action := auth.DeleteObjectAction
if versionId != "" {
action = auth.DeleteObjectVersionAction