mirror of
https://github.com/pgsty/minio.git
synced 2026-07-17 11:14:31 +03:00
Feng Ruohang
73ac524724
The internode storage-REST ReadMultiple endpoint (/rmpl) joined attacker-controlled Bucket/Prefix/Files into a filesystem path with no validation, letting a peer with internode credentials read files outside the drive root (GHSA-xh8f-g2qw-gcm7). ReadMultiple has had no production caller since upstream #20390 removed the last one (listParts) in Sep 2024; multipart now uses ReadParts (/rps). Following the upstream fix, remove the whole API instead of validating paths: route constant and registration, server handler, REST client wrapper, the StorageAPI/xlStorage/xlStorageDiskIDCheck methods, the storageMetricReadMultiple metric, and the ReadMultipleReq/Resp datatypes. Regenerated the msgp and stringer outputs; storageRESTVersion stays at v63. Co-authored-by: Codex <codex@openai.com> Co-authored-by: Claude Code <claude-code@anthropic.com>
54 lines
2.1 KiB
Go
54 lines
2.1 KiB
Go
// Code generated by "stringer -type=storageMetric -trimprefix=storageMetric xl-storage-disk-id-check.go"; DO NOT EDIT.
|
|
|
|
package cmd
|
|
|
|
import "strconv"
|
|
|
|
func _() {
|
|
// An "invalid array index" compiler error signifies that the constant values have changed.
|
|
// Re-run the stringer command to generate them again.
|
|
var x [1]struct{}
|
|
_ = x[storageMetricMakeVolBulk-0]
|
|
_ = x[storageMetricMakeVol-1]
|
|
_ = x[storageMetricListVols-2]
|
|
_ = x[storageMetricStatVol-3]
|
|
_ = x[storageMetricDeleteVol-4]
|
|
_ = x[storageMetricWalkDir-5]
|
|
_ = x[storageMetricListDir-6]
|
|
_ = x[storageMetricReadFile-7]
|
|
_ = x[storageMetricAppendFile-8]
|
|
_ = x[storageMetricCreateFile-9]
|
|
_ = x[storageMetricReadFileStream-10]
|
|
_ = x[storageMetricRenameFile-11]
|
|
_ = x[storageMetricRenameData-12]
|
|
_ = x[storageMetricCheckParts-13]
|
|
_ = x[storageMetricDelete-14]
|
|
_ = x[storageMetricDeleteVersions-15]
|
|
_ = x[storageMetricVerifyFile-16]
|
|
_ = x[storageMetricWriteAll-17]
|
|
_ = x[storageMetricDeleteVersion-18]
|
|
_ = x[storageMetricWriteMetadata-19]
|
|
_ = x[storageMetricUpdateMetadata-20]
|
|
_ = x[storageMetricReadVersion-21]
|
|
_ = x[storageMetricReadXL-22]
|
|
_ = x[storageMetricReadAll-23]
|
|
_ = x[storageMetricStatInfoFile-24]
|
|
_ = x[storageMetricDeleteAbandonedParts-25]
|
|
_ = x[storageMetricDiskInfo-26]
|
|
_ = x[storageMetricDeleteBulk-27]
|
|
_ = x[storageMetricRenamePart-28]
|
|
_ = x[storageMetricReadParts-29]
|
|
_ = x[storageMetricLast-30]
|
|
}
|
|
|
|
const _storageMetric_name = "MakeVolBulkMakeVolListVolsStatVolDeleteVolWalkDirListDirReadFileAppendFileCreateFileReadFileStreamRenameFileRenameDataCheckPartsDeleteDeleteVersionsVerifyFileWriteAllDeleteVersionWriteMetadataUpdateMetadataReadVersionReadXLReadAllStatInfoFileDeleteAbandonedPartsDiskInfoDeleteBulkRenamePartReadPartsLast"
|
|
|
|
var _storageMetric_index = [...]uint16{0, 11, 18, 26, 33, 42, 49, 56, 64, 74, 84, 98, 108, 118, 128, 134, 148, 158, 166, 179, 192, 206, 217, 223, 230, 242, 262, 270, 280, 290, 299, 303}
|
|
|
|
func (i storageMetric) String() string {
|
|
if i >= storageMetric(len(_storageMetric_index)-1) {
|
|
return "storageMetric(" + strconv.FormatInt(int64(i), 10) + ")"
|
|
}
|
|
return _storageMetric_name[_storageMetric_index[i]:_storageMetric_index[i+1]]
|
|
}
|