gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-31 17:28:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix:allow NotResource-only policies in statement validation (#1364)

Browse Source 
Co-authored-by: loverustfs <hello@rustfs.com>
This commit is contained in:
LeonWang0735
2026-01-05 13:07:42 +08:00
committed by GitHub
parent 377ed507c5
commit f86761fae9
4 changed files with 164 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/policy/tests/policy_is_allowed.rs
+46
View File
@@ -611,6 +611,52 @@ struct ArgsBuilder {
} => false;
"24"
)]
#[test_case(
Policy{
version: DEFAULT_VERSION.into(),
statements: vec![
Statement{
effect: Allow,
actions: ActionSet(vec![rustfs_policy::policy::action::Action::S3Action(GetObjectAction)].into_iter().collect()),
resources: ResourceSet::default(), // Empty Resource
not_resources: ResourceSet(vec!["arn:aws:s3:::mybucket/private/*".try_into().unwrap()].into_iter().collect()),
..Default::default()
}
],
..Default::default()
},
ArgsBuilder{
account: "Q3AM3UQ867SPQQA43P2F".into(),
action: "s3:GetObject".into(),
bucket: "mybucket".into(),
object: "public/file.txt".into(),
..Default::default()
} => true;
"notresource_allows_access_outside_blacklist"
)]
#[test_case(
Policy{
version: DEFAULT_VERSION.into(),
statements: vec![
Statement{
effect: Allow,
actions: ActionSet(vec![rustfs_policy::policy::action::Action::S3Action(GetObjectAction)].into_iter().collect()),
resources: ResourceSet::default(), // Empty Resource
not_resources: ResourceSet(vec!["arn:aws:s3:::mybucket/private/*".try_into().unwrap()].into_iter().collect()),
..Default::default()
}
],
..Default::default()
},
ArgsBuilder{
account: "Q3AM3UQ867SPQQA43P2F".into(),
action: "s3:GetObject".into(),
bucket: "mybucket".into(),
object: "private/secret.txt".into(),
..Default::default()
} => false;
"notresource_denies_access_in_blacklist"
)]
fn policy_is_allowed(policy: Policy, args: ArgsBuilder) -> bool {
pollster::block_on(policy.is_allowed(&Args {
account: &args.account,