fix(api): keep GetObjectAttributes server errors and check s3:ListBucket on the bucket

Signed-off-by: Denis Babchuk <babchukdenis@icloud.com>

cmd/auth-handler.go

@@ -425,6 +425,19 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 	return authorizeRequestWithExistingTags(ctx, r, action, "")
 }
 
+// authorizeBucketRequest authorizes a bucket action, such as s3:ListBucket,
+// on the bucket of a request made for one of its objects.
+func authorizeBucketRequest(ctx context.Context, r *http.Request, action policy.Action) APIErrorCode {
+	reqInfo := logger.GetReqInfo(ctx)
+	if reqInfo == nil {
+		return ErrAccessDenied
+	}
+	objectName := reqInfo.ObjectName
+	reqInfo.ObjectName = ""
+	defer func() { reqInfo.ObjectName = objectName }()
+	return authorizeRequest(ctx, r, action)
+}
+
 func deleteObjectAction(versionID string) policy.Action {
 	if versionID != "" {
 		return policy.DeleteObjectVersionAction

cmd/object-handlers.go

@@ -629,12 +629,15 @@ func (api objectAPIHandlers) getObjectAttributesHandler(ctx context.Context, obj
 
 	objInfo, err := objectAPI.GetObjectInfo(ctx, bucket, object, opts)
 	if err != nil {
-		s3Error = authorizeRequest(ctx, r, policy.ListBucketAction)
-		if s3Error == ErrNone {
-			writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
-			return
+		// As with S3, a caller without s3:ListBucket on the bucket gets
+		// AccessDenied in place of NoSuchKey. A server error, such as lost
+		// read quorum, tells nothing about the object and reaches the caller,
+		// who may read the object, as it is.
+		apiErr := toAPIError(ctx, err)
+		if apiErr.HTTPStatusCode < http.StatusInternalServerError && authorizeBucketRequest(ctx, r, policy.ListBucketAction) != ErrNone {
+			apiErr = errorCodes.ToAPIErr(ErrAccessDenied)
 		}
-		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrAccessDenied), r.URL)
+		writeErrorResponse(ctx, w, apiErr, r.URL)
 		return
 	}