CLDSRV-616: Fix bucket policy check for anonymous requests #5748
Conversation
Hello dvasilas,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
Incorrect fix versionThe
Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:
Please check the |
Request integration branchesWaiting for integration branch creation to be requested by the user. To request integration branches, please comment on this pull request with the following command: Alternatively, the |
tests/unit/api/bucketPolicyAuth.js
Outdated
| @@ -35,6 +36,9 @@ const basePolicyObj = { | |||
| }; | |||
| const bucketName = 'matchme'; | |||
| const log = new DummyRequestLogger(); | |||
| const publicUserAuthInfo = new AuthInfo({ | |||
| canonicalID: 'http://acs.amazonaws.com/groups/global/AllUsers', | |||
There was a problem hiding this comment.
Can you pick this from constants:
Line 47 in 77d41df
When checking bucket policies and the following conditions
are true:
- The request is anonymous (`--no-sign-request`)
- There is a bucket policy with AWS principal
Then `_getAccountId` is called in arn === undefined and
causes an exception to be thrown.
The reason is that vault return the following authInfo
with anonymous requests:
{
arn: undefined,
canonicalID: 'http://acs.amazonaws.com/groups/global/AllUsers',
shortid: undefined,
email: undefined,
accountDisplayName: undefined,
IAMdisplayName: undefined
}
The fix is to check is to check is arn === undefined and fail
the check if the policy principal is not '*'
dvasilas
force-pushed
the
bugfix/CLDSRV-616
branch
from
fcf3a49 to
965a80f
Compare
|
/create_integration_branches |
ConflictA conflict has been raised during the creation of I have not created the integration branch. Here are the steps to resolve this conflict: $ git fetch
$ git checkout -B w/7.70/bugfix/CLDSRV-616 origin/development/7.70
$ git merge origin/bugfix/CLDSRV-616
$ # <intense conflict resolution>
$ git commit
$ git push -u origin w/7.70/bugfix/CLDSRV-616The following options are set: create_integration_branches |
|
ping |
ConflictA conflict has been raised during the creation of I have not created the integration branch. Here are the steps to resolve this conflict: $ git fetch
$ git checkout -B w/8.8/bugfix/CLDSRV-616 origin/development/8.8
$ git merge origin/w/7.70/bugfix/CLDSRV-616
$ # <intense conflict resolution>
$ git commit
$ git push -u origin w/8.8/bugfix/CLDSRV-616The following options are set: create_integration_branches |
|
/approve |
Integration data createdI have created the integration data for the additional destination branches.
The following branches will NOT be impacted:
You can set option The following options are set: approve, create_integration_branches |
|
I have successfully merged the changeset of this pull request
The following branches have NOT changed:
Please check the status of the associated issue CLDSRV-616. Goodbye dvasilas. The following options are set: approve, create_integration_branches |
When checking bucket policies and the following conditions are true:
--no-sign-request)Then
_getAccountIdis called inarn === undefinedand causes an exception to be thrown.The reason is that vault return the following
authInfowith anonymous requests:{ arn: undefined, canonicalID: 'http://acs.amazonaws.com/groups/global/AllUsers', shortid: undefined, email: undefined, accountDisplayName: undefined, IAMdisplayName: undefined }The fix is to check is to check is
arn === undefinedand fail the check if the policy principal is not*