Add check for extra input field (#7437)

fixes #6559

cmd/postpolicyform.go

@@ -222,6 +222,22 @@ func checkPostPolicy(formValues http.Header, postPolicyForm PostPolicyForm) erro
 	if !postPolicyForm.Expiration.After(UTCNow()) {
 		return fmt.Errorf("Invalid according to Policy: Policy expired")
 	}
+	// map to store the metadata
+	metaMap := make(map[string]string)
+	for cond, v := range postPolicyForm.Conditions.Policies {
+		if strings.HasPrefix(cond, "$x-amz-meta-") {
+			formCanonicalName := http.CanonicalHeaderKey(strings.TrimPrefix(cond, "$"))
+			metaMap[formCanonicalName] = v.Value
+		}
+	}
+	// Check if any extra metadata field is passed as input
+	for key := range formValues {
+		if strings.HasPrefix(key, "X-Amz-Meta-") {
+			if _, ok := metaMap[key]; !ok {
+				return fmt.Errorf("Invalid according to Policy: Extra input fields: %s", key)
+			}
+		}
+	}
 
 	// Flag to indicate if all policies conditions are satisfied
 	condPassed := true