mirror of
https://github.com/versity/versitygw.git
synced 2026-07-22 07:52:41 +00:00
Ben McClelland
67aaa80d99
The copy-source header was being interpreted differently by request validation and the backend parser. An encoded ?versionId= separator could be decoded at one layer but treated as part of the object path at another, which opened a path traversal risk on filesystem-backed copy operations. Align backend copy-source parsing with validation by decoding the header before splitting the versionId suffix, so both layers derive the same bucket, object, and versionId values. This closes the traversal path and adds regression coverage for encoded copy-source inputs. Reported by 5ud0 / Tarmo Technologies.