gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 08:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(s3): enforce SSE-C copy key validation (#5185)

Browse Source
This commit is contained in:
cxymds
2026-07-24 19:11:36 +08:00
committed by GitHub
parent fa26b6730d
commit f46ea6e14f
11 changed files with 749 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/targets/src/net.rs
+31 -1
View File
@@ -33,6 +33,10 @@ const SENSITIVE_HEADERS: &[&str] = &[
"authorization",
"x-amz-security-token",
"x-amz-content-sha256",
"x-amz-server-side-encryption-customer-key",
"x-amz-server-side-encryption-customer-key-md5",
"x-amz-copy-source-server-side-encryption-customer-key",
"x-amz-copy-source-server-side-encryption-customer-key-md5",
"cookie",
"set-cookie",
];
@@ -466,6 +470,19 @@ mod tests {
headers.insert("authorization", HeaderValue::from_static("AWS4-HMAC-SHA256 Credential=AKIA.../secret"));
headers.insert("x-amz-security-token", HeaderValue::from_static("FQoGZXIvYXdzE.../session-token"));
headers.insert("x-amz-content-sha256", HeaderValue::from_static("e3b0c44298fc1c149afbf4c8996fb924"));
headers.insert("x-amz-server-side-encryption-customer-key", HeaderValue::from_static("destination-key"));
headers.insert(
"x-amz-server-side-encryption-customer-key-md5",
HeaderValue::from_static("destination-key-md5"),
);
headers.insert(
"x-amz-copy-source-server-side-encryption-customer-key",
HeaderValue::from_static("source-key"),
);
headers.insert(
"x-amz-copy-source-server-side-encryption-customer-key-md5",
HeaderValue::from_static("source-key-md5"),
);
headers.insert("cookie", HeaderValue::from_static("session=abc123"));
headers.insert("content-type", HeaderValue::from_static("application/octet-stream"));
headers.insert("user-agent", HeaderValue::from_static("aws-cli/2.0"));
@@ -473,7 +490,16 @@ mod tests {
let params = extract_params_header(&headers);
// Sensitive headers keep their name for correlation but never leak the value.
for name in ["authorization", "x-amz-security-token", "x-amz-content-sha256", "cookie"] {
for name in [
"authorization",
"x-amz-security-token",
"x-amz-content-sha256",
"x-amz-server-side-encryption-customer-key",
"x-amz-server-side-encryption-customer-key-md5",
"x-amz-copy-source-server-side-encryption-customer-key",
"x-amz-copy-source-server-side-encryption-customer-key-md5",
"cookie",
] {
assert_eq!(params.get(name).map(String::as_str), Some(REDACTED_SECRET), "{name} must be redacted");
}
// Non-sensitive headers are preserved verbatim.
@@ -486,6 +512,10 @@ mod tests {
assert!(is_sensitive_header("Authorization"));
assert!(is_sensitive_header("X-Amz-Security-Token"));
assert!(is_sensitive_header("X-AMZ-CONTENT-SHA256"));
assert!(is_sensitive_header("X-Amz-Server-Side-Encryption-Customer-Key"));
assert!(is_sensitive_header("X-Amz-Server-Side-Encryption-Customer-Key-MD5"));
assert!(is_sensitive_header("X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key"));
assert!(is_sensitive_header("X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-MD5"));
assert!(!is_sensitive_header("content-type"));
assert!(!is_sensitive_header("x-amz-request-id"));
}