overtrue a51f8608bd fix(s3): reject unsigned x-amz headers on presigned requests ...

A SigV4 presigned URL only binds the headers listed in X-Amz-SignedHeaders, but the handlers applied every x-amz-* request header regardless. The holder of a presigned PutObject URL signed with SignedHeaders=host could add x-amz-tagging, x-amz-storage-class, x-amz-website-redirect-location, ACL, metadata, Object Lock or SSE headers and have them applied (GHSA-g8w9-qw9q-fghr). Reject such requests at the S3 access boundary with 403 AccessDenied and the AWS message "There were headers present in the request which were not signed"; x-amz-cf-id stays tolerated for CloudFront. SigV2 and header-signed SigV4 requests are unchanged.

Regression tests are named after the advisory (unit tests in rustfs/src/auth.rs, e2e in crates/e2e_test/src/presigned_negative_test.rs with a signed-tagging positive control); the security smoke floor rises to 20 and the e2e selection digests are refreshed for the two new cases.

2026-09-08 00:18:14 +08:00

..

architecture

docs: scope agent guidance and consolidate review workflows (#7419)

2026-09-07 23:58:05 +08:00

operations

feat(observability): diagnose node-local S3 write failures (#7407)

2026-09-07 22:24:50 +08:00

postmortems

fix(replication): send an integrity header on Object Lock PUTs (#7097)

2026-09-03 20:26:44 +08:00

testing

fix(s3): reject unsigned x-amz headers on presigned requests

2026-09-08 00:18:14 +08:00