fix(security): add deny_unknown_fields to deserialization structs (#3198)

* fix(security): add deny_unknown_fields to deserialization structs

Prevent silent acceptance of malformed or adversarial payloads.

- policy: Policy, BucketPolicy, Statement, BPStatement, PrincipalObject
- notify: S3KeyFilter custom deserializer rejects unknown child elements
- update: VersionInfo (remote HTTP response)

26 policy + 82 notify tests pass.

* fix(update): keep version response forward compatible

---------

Co-authored-by: houseme <housemecn@gmail.com>

crates/notify/src/rules/xml_config.rs

@@ -207,7 +207,7 @@ impl<'de> Deserialize<'de> for S3KeyFilter {
                             self.filter_rules = s3key_content.get_filter_rules();
                         }
                         _ => {
-                            map.next_value::<serde::de::IgnoredAny>()?;
+                            return Err(serde::de::Error::unknown_field(&key, &["S3Key"]));
                         }
                     }
                 }

crates/policy/src/policy/policy.rs

@@ -55,6 +55,7 @@ impl Args<'_> {
 }
 
 #[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[serde(deny_unknown_fields)]
 pub struct Policy {
     #[serde(default, rename = "ID")]
     pub id: ID,
@@ -192,6 +193,7 @@ pub struct BucketPolicyArgs<'a> {
 /// Bucket Policy with AWS S3-compatible JSON serialization.
 /// Empty optional fields are omitted from output to match AWS format.
 #[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[serde(deny_unknown_fields)]
 pub struct BucketPolicy {
     #[serde(default, rename = "Id", skip_serializing_if = "ID::is_empty")]
     pub id: ID,

crates/policy/src/policy/principal.rs

@@ -68,6 +68,7 @@ enum PrincipalFormat {
 }
 
 #[derive(serde::Deserialize)]
+#[serde(deny_unknown_fields)]
 struct PrincipalObject {
     #[serde(rename = "AWS", default)]
     aws: Option<PrincipalValues>,

crates/policy/src/policy/statement.rs

@@ -22,6 +22,7 @@ use crate::error::{Error, Result};
 use serde::{Deserialize, Serialize};
 
 #[derive(Serialize, Deserialize, Clone, Default, Debug)]
+#[serde(deny_unknown_fields)]
 pub struct Statement {
     #[serde(rename = "Sid", default)]
     pub sid: ID,
@@ -284,7 +285,7 @@ impl PartialEq for Statement {
 /// Bucket Policy Statement with AWS S3-compatible JSON serialization.
 /// Empty optional fields are omitted from output to match AWS format.
 #[derive(Debug, Deserialize, Serialize, Default, Clone)]
-#[serde(rename_all = "PascalCase", default)]
+#[serde(rename_all = "PascalCase", default, deny_unknown_fields)]
 pub struct BPStatement {
     #[serde(rename = "Sid", default, skip_serializing_if = "ID::is_empty")]
     pub sid: ID,