gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-25 13:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: reject Snowball extract path traversal

Browse Source
This commit is contained in:
overtrue
2026-05-27 23:19:53 +08:00
parent 0c52334480
commit 95836a0a4d
3 changed files with 165 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/policy/src/policy/resource.rs
+3 -1
View File
@@ -192,7 +192,7 @@ impl Resource {
return true;
}
if wildcard::is_match(resolved_pattern, resource) {
if cp != "." && wildcard::is_match(resolved_pattern, &cp) {
return true;
}
}
@@ -287,6 +287,8 @@ mod tests {
#[test_case("arn:aws:s3:::mybucket/*","mybucket10/myobject" => false; "13")]
#[test_case("arn:aws:s3:::mybucket?0/2010/photos/*","mybucket0/2010/photos/1.jpg" => false; "14")]
#[test_case("arn:aws:s3:::mybucket","mybucket/myobject" => false; "15")]
#[test_case("arn:aws:s3:::attacker-bucket/*","attacker-bucket/../victim-bucket/evil.txt" => false; "16")]
#[test_case("arn:aws:s3:::attacker-bucket/*","attacker-bucket/safe/../../victim-bucket/evil.txt" => false; "17")]
fn test_resource_is_match(resource: &str, object: &str) -> bool {
let resource: Resource = resource.try_into().unwrap();