gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-28 16:07:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): add deny_unknown_fields to deserialization structs (#3198)

Browse Source 
* fix(security): add deny_unknown_fields to deserialization structs

Prevent silent acceptance of malformed or adversarial payloads.

- policy: Policy, BucketPolicy, Statement, BPStatement, PrincipalObject
- notify: S3KeyFilter custom deserializer rejects unknown child elements
- update: VersionInfo (remote HTTP response)

26 policy + 82 notify tests pass.

* fix(update): keep version response forward compatible

---------

Co-authored-by: houseme <housemecn@gmail.com>
This commit is contained in:
安正超
2026-06-03 23:33:28 +08:00
committed by GitHub
parent e0a03ce10b
commit 1838922f07
4 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/notify/src/rules/xml_config.rs
+1 -1
View File
@@ -207,7 +207,7 @@ impl<'de> Deserialize<'de> for S3KeyFilter {
self.filter_rules = s3key_content.get_filter_rules(); self.filter_rules = s3key_content.get_filter_rules();
} }
_ => { _ => {
map.next_value::<serde::de::IgnoredAny>()?; return Err(serde::de::Error::unknown_field(&key, &["S3Key"]));
} }
} }
} }
crates/policy/src/policy/policy.rs
+2
View File
@@ -55,6 +55,7 @@ impl Args<'_> {
} }
#[derive(Serialize, Deserialize, Clone, Default, Debug)] #[derive(Serialize, Deserialize, Clone, Default, Debug)]
#[serde(deny_unknown_fields)]
pub struct Policy { pub struct Policy {
#[serde(default, rename = "ID")] #[serde(default, rename = "ID")]
pub id: ID, pub id: ID,
@@ -192,6 +193,7 @@ pub struct BucketPolicyArgs<'a> {
/// Bucket Policy with AWS S3-compatible JSON serialization. /// Bucket Policy with AWS S3-compatible JSON serialization.
/// Empty optional fields are omitted from output to match AWS format. /// Empty optional fields are omitted from output to match AWS format.
#[derive(Serialize, Deserialize, Clone, Default, Debug)] #[derive(Serialize, Deserialize, Clone, Default, Debug)]
#[serde(deny_unknown_fields)]
pub struct BucketPolicy { pub struct BucketPolicy {
#[serde(default, rename = "Id", skip_serializing_if = "ID::is_empty")] #[serde(default, rename = "Id", skip_serializing_if = "ID::is_empty")]
pub id: ID, pub id: ID,
crates/policy/src/policy/principal.rs
+1
View File
@@ -68,6 +68,7 @@ enum PrincipalFormat {
} }
#[derive(serde::Deserialize)] #[derive(serde::Deserialize)]
#[serde(deny_unknown_fields)]
struct PrincipalObject { struct PrincipalObject {
#[serde(rename = "AWS", default)] #[serde(rename = "AWS", default)]
aws: Option<PrincipalValues>, aws: Option<PrincipalValues>,
crates/policy/src/policy/statement.rs
+2 -1
View File
@@ -22,6 +22,7 @@ use crate::error::{Error, Result};
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
#[derive(Serialize, Deserialize, Clone, Default, Debug)] #[derive(Serialize, Deserialize, Clone, Default, Debug)]
#[serde(deny_unknown_fields)]
pub struct Statement { pub struct Statement {
#[serde(rename = "Sid", default)] #[serde(rename = "Sid", default)]
pub sid: ID, pub sid: ID,
@@ -284,7 +285,7 @@ impl PartialEq for Statement {
/// Bucket Policy Statement with AWS S3-compatible JSON serialization. /// Bucket Policy Statement with AWS S3-compatible JSON serialization.
/// Empty optional fields are omitted from output to match AWS format. /// Empty optional fields are omitted from output to match AWS format.
#[derive(Debug, Deserialize, Serialize, Default, Clone)] #[derive(Debug, Deserialize, Serialize, Default, Clone)]
#[serde(rename_all = "PascalCase", default)] #[serde(rename_all = "PascalCase", default, deny_unknown_fields)]
pub struct BPStatement { pub struct BPStatement {
#[serde(rename = "Sid", default, skip_serializing_if = "ID::is_empty")] #[serde(rename = "Sid", default, skip_serializing_if = "ID::is_empty")]
pub sid: ID, pub sid: ID,