mirror of
https://github.com/versity/versitygw.git
synced 2026-09-07 08:36:54 +00:00
niksis02
577470214d
Validate required signed headers for both Authorization-header SigV4 requests and presigned URLs. The required signed header set is now `host` plus every incoming header with the `x-amz-` prefix. During request reconstruction, signed headers and explicitly ignored headers are copied into the generated request used for signature verification. If an incoming `x-amz-*` header is present but missing from the client-provided `SignedHeaders`, return `AccessDenied` with a `HeadersNotSigned` field. The `host` header remains part of the canonical request and signed header calculation. Previously, a client could sign a request without an S3 control header and then add that header after signing. For example, a presigned `PUT` URL could be generated with only `host` signed, then the actual request could include an unsigned `X-Amz-Tagging` or `X-Amz-Copy-Source` header. Because the verifier reconstructed the request only from `SignedHeaders`, that extra header was omitted from signature calculation and could pass authentication even though it changed the request semantics. This is now rejected with `AccessDenied`. Expose v4 helper methods for checking required and ignored headers, and update canonical header signing so ignored headers can still be included when a client explicitly lists them in `SignedHeaders`, while `Authorization` remains excluded from signature calculation.
33 lines
801 B
Go
33 lines
801 B
Go
package v4
|
|
|
|
// IgnoredHeaders is a list of headers that are ignored during signing
|
|
var IgnoredHeaders = Rules{
|
|
ExcludeList{
|
|
MapRule{
|
|
"Authorization": struct{}{},
|
|
"User-Agent": struct{}{},
|
|
"X-Amzn-Trace-Id": struct{}{},
|
|
"Expect": struct{}{},
|
|
"Transfer-Encoding": struct{}{},
|
|
},
|
|
},
|
|
}
|
|
|
|
// RequiredSignedHeaders are request headers that must be part of SignedHeaders
|
|
// whenever they are present on the request.
|
|
var RequiredSignedHeaders = Rules{
|
|
AllowList{
|
|
MapRule{
|
|
"Host": struct{}{},
|
|
},
|
|
},
|
|
Patterns{"X-Amz-"},
|
|
}
|
|
|
|
// AllowedQueryHoisting is a allowed list for Build query headers. The boolean value
|
|
// represents whether or not it is a pattern.
|
|
var AllowedQueryHoisting = InclusiveRules{
|
|
ExcludeList{RequiredSignedHeaders},
|
|
Patterns{"X-Amz-"},
|
|
}
|