gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-08 06:13:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): stop logging STS AssumeRole JWT claims (#5802)

Browse Source
This commit is contained in:
Zhengchao An
2026-08-07 22:17:56 +08:00
committed by GitHub
parent 766afe12fb
commit 7553715f62
2 changed files with 81 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check_logging_guardrails.sh
+11
View File
@@ -690,6 +690,17 @@ if [[ -n "$unmasked_revoke_fields" ]]; then
exit 1
fi
# STS claims carry caller-supplied identity material (parent user, session policy, JWT
# fields). Interpolating the claims map into any log or error repeats the
# GHSA-r54g-49rx-98cr / GHSA-8cm2-h255-v749 credential-leak class. Only derived metadata
# such as claims.len() may be logged (see trace_assume_role_claims in sts.rs).
sts_claims_content_logs="$(rg -n '\{:\?\}.*claims|claims.*\{:\?\}|\{&?claims:\?\}|[?%]\s*&?claims\b' rustfs/src/admin/handlers/sts.rs || true)"
if [[ -n "$sts_claims_content_logs" ]]; then
echo "❌ logging guardrail violation: STS handlers must not interpolate JWT claims into logs or errors (GHSA-r54g-49rx-98cr / GHSA-8cm2-h255-v749 class); log derived metadata such as claims.len() instead" >&2
echo "$sts_claims_content_logs" >&2
exit 1
fi
heal_hotpath_files=(
"crates/ecstore/src/store/heal.rs"
"crates/ecstore/src/store/mod.rs"