mirror of
https://github.com/versity/versitygw.git
synced 2026-10-22 06:12:39 +00:00
Ben McClelland
f51367853d
Follow-up to #2514, which added PosixOpts.ExcludeDirs (--exclude-dirs, VGW_EXCLUDE_DIRS) so the listings can skip filesystem control directories such as ZFS's .zfs. The walks matched skipped names against every directory entry, files included. In WalkVersions, returning fs.SkipDir for a file skips the rest of its parent directory, so a regular file named like an excluded directory (for example an object "d/.zfs") made ListObjectVersions drop every sibling that sorted after it. Walk hid the file itself. Previously only .sgwtmp was skipped, which clients can't create, but excluded names are chosen by the operator and any client can PUT such a key. Walk and WalkVersions now skip only directories, so a file with an excluded name is listed like any other object. Excluded names were also not reserved: requests could still read and write objects under an excluded directory that the listings never show. On ZFS, .zfs is reachable by name even with snapdir=hidden, so GetObject could read snapshot contents. That bypasses bucket policies scoped to a key prefix and exposes data that was deleted or overwritten since the snapshot was taken. On other filesystems, objects written there were orphans that no listing reports. validateObjectName now rejects, with ReservedObjectKey, any key that has an excluded name as a directory at any depth, ignoring case and after resolving "..", "." and repeated slashes. Every object operation already calls it. A directory-object key (trailing slash) counts its last element as a directory; a plain key with an excluded last element is still a valid file. The new ErrExcludedObjectKey keeps the ReservedObjectKey code with a description that fits excluded directories, leaving the .sgwtmp error unchanged. Nothing changes when ExcludeDirs is empty. posix.New now also rejects "." and ".." as excluded names, since they can never match a directory entry and would silently do nothing.