self-hosted/minio
self-hosted/minio
1
0
Fork 0
mirror of https://github.com/minio/minio synced 2024-10-14 11:52:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ignore signaturev2 for policy header check (#19551)

Browse source
This commit is contained in:
jiuker 2024-04-20 00:45:54 +08:00 committed by GitHub
parent cd50e9b4bc
commit 9205434ed3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
cmd/post-policy_test.go
View file

@ -610,7 +610,6 @@ func newPostRequestV2(endPoint, bucketName, objectName string, accessKey, secret
"key": objectName + "/${filename}", "key": objectName + "/${filename}",
"policy": encodedPolicy, "policy": encodedPolicy,
"signature": signature, "signature": signature,
"X-Amz-Ignore-signature": "",
"X-Amz-Ignore-AWSAccessKeyId": "", "X-Amz-Ignore-AWSAccessKeyId": "",
} }

5
cmd/postpolicyform.go
View file

@ -347,6 +347,11 @@ func checkPostPolicy(formValues http.Header, postPolicyForm PostPolicyForm) erro
} }
delete(checkHeader, formCanonicalName) delete(checkHeader, formCanonicalName)
} }
// For SignV2 - Signature field will be ignored
// Policy is generated from Signature with other fields, so it should be ignored
if _, ok := formValues[xhttp.AmzSignatureV2]; ok {
delete(checkHeader, xhttp.AmzSignatureV2)
}
if len(checkHeader) != 0 { if len(checkHeader) != 0 {
logKeys := make([]string, 0, len(checkHeader)) logKeys := make([]string, 0, len(checkHeader))

2
cmd/signature-v4.go
View file

@ -154,7 +154,7 @@ func getSignature(signingKey []byte, stringToSign string) string {
// Check to see if Policy is signed correctly. // Check to see if Policy is signed correctly.
func doesPolicySignatureMatch(formValues http.Header) (auth.Credentials, APIErrorCode) { func doesPolicySignatureMatch(formValues http.Header) (auth.Credentials, APIErrorCode) {
// For SignV2 - Signature field will be valid // For SignV2 - Signature field will be valid
if _, ok := formValues["Signature"]; ok { if _, ok := formValues[xhttp.AmzSignatureV2]; ok {
return doesPolicySignatureV2Match(formValues) return doesPolicySignatureV2Match(formValues)
} }
return doesPolicySignatureV4Match(formValues) return doesPolicySignatureV4Match(formValues)