Fix policy bugs Null conditions and canonical names (#7021)

This PR fixes two different issues

- Null condition implementation
- HTTP Canonical request value names

This PR fixes handling of null conditions and
handle HTTP canonical names in request values.

This PR was tested with policies mentioned in the following blog
https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/

Fixes #6955
This commit is contained in:
Harshavardhana
2018-12-26 02:03:28 -08:00
committed by GitHub
parent fb8d0d7cf7
commit 2db22deb93
6 changed files with 47 additions and 25 deletions

View File

@@ -18,6 +18,7 @@ package condition
import (
"fmt"
"net/http"
"sort"
"strings"
@@ -45,7 +46,12 @@ type stringLikeFunc struct {
// evaluate() - evaluates to check whether value by Key in given values is wildcard
// matching in condition values.
func (f stringLikeFunc) evaluate(values map[string][]string) bool {
for _, v := range values[f.k.Name()] {
requestValue, ok := values[http.CanonicalHeaderKey(f.k.Name())]
if !ok {
requestValue = values[f.k.Name()]
}
for _, v := range requestValue {
if !f.values.FuncMatch(wildcard.Match, v).IsEmpty() {
return true
}