gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-07 22:03:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(s3): enforce RestrictPublicBuckets for anonymous access (#2033)

Browse Source 
Signed-off-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
安正超
2026-03-01 20:50:19 +08:00
committed by GitHub
parent c452f24487
commit f0c5d762f3
3 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/storage/access.rs
+16 -3
View File
@@ -460,7 +460,7 @@ pub async fn authorize_request<T>(req: &mut S3Request<T>, action: Action) -> S3R
}
if action != Action::S3Action(S3Action::ListAllMyBucketsAction) {
if PolicySys::is_allowed(&BucketPolicyArgs {
let policy_allowed = PolicySys::is_allowed(&BucketPolicyArgs {
bucket: req_info.bucket.as_deref().unwrap_or(""),
action,
is_owner: false,
@@ -469,8 +469,21 @@ pub async fn authorize_request<T>(req: &mut S3Request<T>, action: Action) -> S3R
conditions: &conditions,
object: req_info.object.as_deref().unwrap_or(""),
})
.await
{
.await;
if policy_allowed {
// RestrictPublicBuckets: when true, deny public access even if bucket policy allows it.
// Fail closed: if we cannot read the config, do not allow public access.
match metadata_sys::get_public_access_block_config(bucket_name).await {
Ok((config, _)) => {
if config.restrict_public_buckets.unwrap_or(false) {
return Err(s3_error!(AccessDenied, "Access Denied"));
}
}
Err(_) => {
return Err(s3_error!(AccessDenied, "Access Denied"));
}
}
return Ok(());
}