From 13512170b579f98036459181cbbffa4b21c5b6f2 Mon Sep 17 00:00:00 2001 From: Poorna Date: Thu, 27 Jun 2024 19:44:56 -0700 Subject: [PATCH] list: Do not decrypt SSE-S3 Etags in a non encrypted format (#20008) --- cmd/encryption-v1.go | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/cmd/encryption-v1.go b/cmd/encryption-v1.go index 7bd46593d..e4801ca48 100644 --- a/cmd/encryption-v1.go +++ b/cmd/encryption-v1.go @@ -134,11 +134,16 @@ func DecryptETags(ctx context.Context, k *kms.KMS, objects []ObjectInfo) error { SSES3SinglePartObjects := make(map[int]bool) for i, object := range batch { if kind, ok := crypto.IsEncrypted(object.UserDefined); ok && kind == crypto.S3 && !crypto.IsMultiPart(object.UserDefined) { - SSES3SinglePartObjects[i] = true - - metadata = append(metadata, object.UserDefined) - buckets = append(buckets, object.Bucket) - names = append(names, object.Name) + ETag, err := etag.Parse(object.ETag) + if err != nil { + continue + } + if ETag.IsEncrypted() { + SSES3SinglePartObjects[i] = true + metadata = append(metadata, object.UserDefined) + buckets = append(buckets, object.Bucket) + names = append(names, object.Name) + } } } @@ -190,7 +195,7 @@ func DecryptETags(ctx context.Context, k *kms.KMS, objects []ObjectInfo) error { if err != nil { return err } - if SSES3SinglePartObjects[i] && ETag.IsEncrypted() { + if SSES3SinglePartObjects[i] { ETag, err = etag.Decrypt(keys[0][:], ETag) if err != nil { return err