niksis02 1b9fedb7e6 fix: enforce object lock on browser-based POST object uploads ...

`POSTObject` wrote directly to the backend without the `CheckObjectAccess` object lock check that `PutObject`, `CopyObject` and `CompleteMultipartUpload` perform. In a versioning-disabled bucket, a browser-based `POST` could therefore silently overwrite an object protected by a legal hold, a `COMPLIANCE` retention or a `GOVERNANCE` retention. S3 has no such gap: it allows object lock only on versioned buckets, where an overwrite creates a new version.

`POSTObject` now calls `auth.CheckObjectAccess` with `BypassOverwrite` just before writing to the backend, matching `PutObject`. A legal hold or `COMPLIANCE` retention always blocks the overwrite. A `GOVERNANCE` retention blocks it unless the caller, root included, has an explicit `s3:BypassGovernanceRetention` grant. Versioning-enabled buckets skip the check because the upload creates a new version.

2026-09-23 18:13:25 +04:00

..

AbortMultipartUpload.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

Access_Control.go

feat: add s3:if-match and s3:if-none-match policy condition keys

2026-09-09 17:18:42 +04:00

bench.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

CompleteMultipartUpload.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

concurrency.go

test: add github actions functional tests for posix sidecar option

2026-04-22 13:23:46 -07:00

CopyObject.go

feat(azure): server-side copy with download+reupload fallback

2026-08-27 16:37:28 -07:00

CreateBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

CreateMultipartUpload.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

data-io.go

chore: add missing copyright headers to files

2024-05-06 16:16:31 -07:00

DeleteBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

DeleteObject.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

DeleteObjects.go

fix: treat root-level non-directory entries as non-existing buckets in posix

2026-09-16 20:14:09 +04:00

DeleteObjectTagging.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

general.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

GetBucketAcl.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketLocation.go

fix: return null in GetBucketLocation for us-east-1

2026-01-05 16:24:01 +04:00

GetBucketLockConfiguration.go

fix: omit ObjectLockConfiguration Rule when there is no default retention

2026-09-16 08:16:55 -07:00

GetBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicyStatus.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketVersioning.go

feat: govern GetBucketVersioning with the regular access checks

2026-08-31 16:47:49 +04:00

GetBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

GetObject.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectAttributes.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectLegalHold.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectRetention.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectTagging.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

group-tests.go

fix: enforce object lock on browser-based POST object uploads

2026-09-23 18:13:25 +04:00

HeadBucket.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

HeadObject.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

iam_access_control.go

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iam_add_client_id_to_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_assume_role_with_web_identity.go

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iam_auth.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam_create_access_key.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_create_oidc_provider.go

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iam_create_role.go

fix: role last-used tracking, and record S3 requests in last-used metadata

2026-09-01 19:55:27 +04:00

iam_create_user.go

feat: add IAM Role CRUD

2026-08-25 01:03:22 +04:00

iam_delete_access_key.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_delete_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_delete_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_delete_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_delete_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_delete_user.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_get_access_key_last_used.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_get_caller_identity.go

feat: add STS web identity federation, IAM policy Condition support, and access control enforcement

2026-08-25 01:06:25 +04:00

iam_get_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_get_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_get_role.go

fix: role last-used tracking, and record S3 requests in last-used metadata

2026-09-01 19:55:27 +04:00

iam_get_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_get_user.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam_list_access_keys.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_list_oidc_provider_tags.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_list_oidc_providers.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_list_role_policies.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_role_tags.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_list_roles.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_user_policies.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_user_tags.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_users.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_put_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_put_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_query_auth.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

iam_remove_client_id_from_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_tag_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_tag_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_tag_user.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_untag_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_untag_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_untag_user.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_update_access_key.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_update_assume_role_policy.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_update_oidc_provider_thumbprint.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_update_user.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListBuckets.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

ListMultipartUploads.go

fix: make ListMultipartUploads ordering deterministic and stabilize test timing

2026-09-08 20:23:09 +04:00

ListObjects.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListObjectsV2.go

feat(azure): carry Azure blob marker in continuation token for pagination

2026-08-27 16:40:43 -07:00

ListObjectVersions.go

feat: add versioning support for directory objects in posix

2026-09-19 02:10:34 +04:00

ListParts.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

no_acl.go

feat: revert ignore object ACL behavior

2026-03-02 19:30:57 +04:00

NotImplemented_actions.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

OPTIONS.go

feat: add option for default global cors allow origin headers

2026-01-08 16:23:23 -08:00

output.go

feat: add live GitHub OIDC end-to-end test for AssumeRoleWithWebIdentity

2026-08-25 01:07:33 +04:00

posix.go

fix: stop posix mixing up keys that differ only by a trailing slash

2026-09-19 22:26:47 +04:00

PostObject.go

fix: add integeration tests

2026-08-29 12:06:50 +05:00

presigned_urls.go

fix: strip aws-chunked when the request declares no payload type

2026-09-22 02:05:00 +04:00

public_bucket.go

fix: honor explicit public bucket policy deny

2026-05-22 00:01:24 +04:00

PutBucketAcl.go

fix: adds validation for bucket canned ACL

2025-11-03 22:59:06 +04:00

PutBucketCors.go

fix: fixes PutBucketCors CORSRules validation

2026-02-24 16:59:38 +04:00

PutBucketOwnershipControls.go

fix: fix empty ownership control rules panic

2026-05-23 04:18:06 +04:00

PutBucketPolicy.go

feat: add s3:if-match and s3:if-none-match policy condition keys

2026-09-09 17:18:42 +04:00

PutBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

PutBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutBucketWebsite.go

fix: return InvalidArgument for an empty website configuration

2026-09-20 11:04:22 -07:00

PutObject.go

fix: match S3's Content-Encoding error details for aws-chunked with UNSIGNED-PAYLOAD

2026-09-22 02:04:34 +04:00

PutObjectLegalHold.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

PutObjectLockConfiguration.go

fix: validate object lock default retention upper limits

2026-06-16 22:48:51 +04:00

PutObjectRetention.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

PutObjectTagging.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

s3_iam_access_control.go

feat: add s3:if-match and s3:if-none-match policy condition keys

2026-09-09 17:18:42 +04:00

s3_iam_principals.go

feat: accept principal ARNs in bucket policies under standalone IAM

2026-09-03 23:51:55 +04:00

s3_iam_session_access_control.go

feat: accept principal ARNs in bucket policies under standalone IAM

2026-09-03 23:51:55 +04:00

s3_iam_utils.go

feat: add s3:if-match and s3:if-none-match policy condition keys

2026-09-09 17:18:42 +04:00

s3conf.go

tests: build the integration SDK config without the host's AWS setup

2026-09-08 07:21:40 -07:00

server.go

feat: migrate Fiber to v3.3.0

2026-06-15 14:48:31 +04:00

signed_streaming_payload_trailer.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

signed_streaming_payload.go

feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests

2025-12-26 21:16:01 +04:00

sigv4_auth.go

fix: reject empty Content-MD5 on PUT operations

2026-06-15 18:53:42 +04:00

unsigned_streaming_payload_trailer.go

fix: match S3's Content-Encoding error details for aws-chunked with UNSIGNED-PAYLOAD

2026-09-22 02:04:34 +04:00

UploadPart.go

fix: use content-legnth for PutObject and UploadPart allocation sizes

2026-09-20 11:46:23 -07:00

UploadPartCopy.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

utils.go

fix: enforce object lock on browser-based POST object uploads

2026-09-23 18:13:25 +04:00

versioning.go

fix: handle the null version id correctly in posix versioning

2026-09-21 20:34:47 +04:00

WebsiteHosting.go

Bugfix: url-encoded chars on the website listener

2026-08-19 13:54:34 +02:00

WORM_protection.go

fix: enforce object lock on browser-based POST object uploads

2026-09-23 18:13:25 +04:00