astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-12 10:35:33 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(s3): enforce tag count and object lock permissions on proxy reads

Browse Source 
Skip x-amz-tagging-count and X-Amz-Tagging in setObjectHeaders UserDefined iteration and proxyHeadToRepTarget metadata copies so opts.TaggingCount/opts.Tagging remains the sole gate without emitting duplicate headers. Make FilterObjectLockMetadata case-insensitive so canonical-case X-Amz-Object-Lock-* headers from peer HEAD responses are stripped when s3:GetObjectRetention or s3:GetObjectLegalHold is denied while preserved for authorized callers.

Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-11-12 10:18:54 +08:00
parent 265c31b714
commit ea37a7e8b0
5 changed files with 204 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/bucket/object/lock/lock_test.go
+22
View File
@@ -608,6 +608,28 @@ func TestFilterObjectLockMetadata(t *testing.T) {
"x-amz-object-lock-retain-until-date": "2020-02-01",
},
},
{
metadata: map[string]string{
"X-Amz-Object-Lock-Legal-Hold": "ON",
"X-Amz-Object-Lock-Mode": "GOVERNANCE",
"X-Amz-Object-Lock-Retain-Until-Date": "2026-12-31T00:00:00Z",
},
expected: map[string]string{},
filterRetention: true,
filterLegalHold: true,
},
{
metadata: map[string]string{
"X-Amz-Object-Lock-Legal-Hold": "ON",
"X-Amz-Object-Lock-Mode": "GOVERNANCE",
"X-Amz-Object-Lock-Retain-Until-Date": "2026-12-31T00:00:00Z",
},
expected: map[string]string{
"X-Amz-Object-Lock-Legal-Hold": "ON",
"X-Amz-Object-Lock-Mode": "GOVERNANCE",
"X-Amz-Object-Lock-Retain-Until-Date": "2026-12-31T00:00:00Z",
},
},
}
for i, tt := range tests {