Ben McClelland 67aaa80d99 fix: copy-source parsing mismatch that could bypass path validation ...

The copy-source header was being interpreted differently by request
validation and the backend parser. An encoded ?versionId= separator
could be decoded at one layer but treated as part of the object path
at another, which opened a path traversal risk on filesystem-backed
copy operations.

Align backend copy-source parsing with validation by decoding the
header before splitting the versionId suffix, so both layers derive
the same bucket, object, and versionId values. This closes the
traversal path and adds regression coverage for encoded
copy-source inputs.

Reported by 5ud0 / Tarmo Technologies.

2026-07-03 13:49:59 -07:00

..

AbortMultipartUpload.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

Access_Control.go

fix: normalize object keys during bucket policy evaluation

2026-05-27 22:20:39 +04:00

bench.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

CompleteMultipartUpload.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

concurrency.go

test: add github actions functional tests for posix sidecar option

2026-04-22 13:23:46 -07:00

CopyObject.go

fix: support asterisk read preconditions

2026-06-16 21:36:45 +04:00

CreateBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

CreateMultipartUpload.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

data-io.go

chore: add missing copyright headers to files

2024-05-06 16:16:31 -07:00

DeleteBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

DeleteObject.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteObjects.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteObjectTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

general.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

GetBucketAcl.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketLocation.go

fix: return null in GetBucketLocation for us-east-1

2026-01-05 16:24:01 +04:00

GetBucketLockConfiguration.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicyStatus.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

GetObject.go

fix: support asterisk read preconditions

2026-06-16 21:36:45 +04:00

GetObjectAttributes.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

GetObjectLegalHold.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

GetObjectRetention.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

GetObjectTagging.go

fix: removes the NoSuchTagSet error in GetObjecTagging

2026-01-02 23:31:35 +04:00

group-tests.go

fix: copy-source parsing mismatch that could bypass path validation

2026-07-03 13:49:59 -07:00

HeadBucket.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

HeadObject.go

fix: support asterisk read preconditions

2026-06-16 21:36:45 +04:00

iam.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListBuckets.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

ListMultipartUploads.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListObjects.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListObjectsV2.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

ListObjectVersions.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListParts.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

no_acl.go

feat: revert ignore object ACL behavior

2026-03-02 19:30:57 +04:00

NotImplemented_actions.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

OPTIONS.go

feat: add option for default global cors allow origin headers

2026-01-08 16:23:23 -08:00

output.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

posix.go

fix: retry link on ENOENT caused by racing DeleteObject

2026-04-02 08:14:44 -07:00

PostObject.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

presigned_urls.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

public_bucket.go

fix: honor explicit public bucket policy deny

2026-05-22 00:01:24 +04:00

PutBucketAcl.go

fix: adds validation for bucket canned ACL

2025-11-03 22:59:06 +04:00

PutBucketCors.go

fix: fixes PutBucketCors CORSRules validation

2026-02-24 16:59:38 +04:00

PutBucketOwnershipControls.go

fix: fix empty ownership control rules panic

2026-05-23 04:18:06 +04:00

PutBucketPolicy.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

PutBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

PutBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutBucketWebsite.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

PutObject.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

PutObjectLegalHold.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

PutObjectLockConfiguration.go

fix: validate object lock default retention upper limits

2026-06-16 22:48:51 +04:00

PutObjectRetention.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

PutObjectTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

s3conf.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

server.go

feat: migrate Fiber to v3.3.0

2026-06-15 14:48:31 +04:00

signed_streaming_payload_trailer.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

signed_streaming_payload.go

feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests

2025-12-26 21:16:01 +04:00

sigv4_auth.go

fix: reject empty Content-MD5 on PUT operations

2026-06-15 18:53:42 +04:00

unsigned_streaming_payload_trailer.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

UploadPart.go

test(azure): widen multipart test parts above min size; tighten isQuotedEtag

2026-06-30 13:28:12 -07:00

UploadPartCopy.go

fix: support asterisk read preconditions

2026-06-16 21:36:45 +04:00

utils.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

versioning.go

fix: copy-source parsing mismatch that could bypass path validation

2026-07-03 13:49:59 -07:00

WebsiteHosting.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

WORM_protection.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00