MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-29 05:19:03 -05:00
Code Issues Packages Projects Releases Wiki Activity

policy: Do not return an error for invalid value during parsing (#9442)

Browse Source 
s3:HardwareInfo was removed recently. Users having that admin action
stored in the backend will have an issue starting the server.

To fix this, we need to avoid returning an error in Marshal/Unmarshal
when they encounter an invalid action and validate only in specific
location.

Currently the validation is done and in ParseConfig().
This commit is contained in:
Anis Elleuch
2020-05-10 18:55:28 +01:00
committed by GitHub
parent b5ed42c845
commit 52a1d248b2
12 changed files with 116 additions and 684 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
pkg/iam/policy/statement.go
View File

@@ -17,7 +17,6 @@
package iampolicy
import (
"encoding/json"
"strings"
"github.com/minio/minio/pkg/bucket/policy"
@@ -63,11 +62,11 @@ func (statement Statement) IsAllowed(args Args) bool {
}
func (statement Statement) isAdmin() bool {
for action := range statement.Actions {
if !AdminAction(action).IsValid() {
return false
if AdminAction(action).IsValid() {
return true
}
}
return true
return false
}
// isValid - checks whether statement is valid or not.
@@ -81,6 +80,9 @@ func (statement Statement) isValid() error {
}
if statement.isAdmin() {
if err := statement.Actions.ValidateAdmin(); err != nil {
return err
}
for action := range statement.Actions {
keys := statement.Conditions.Keys()
keyDiff := keys.Difference(adminActionConditionKeyMap[action])
@@ -91,6 +93,10 @@ func (statement Statement) isValid() error {
return nil
}
if !statement.SID.IsValid() {
return Errorf("invalid SID %v", statement.SID)
}
if len(statement.Resources) == 0 {
return Errorf("Resource must not be empty")
}
@@ -99,6 +105,10 @@ func (statement Statement) isValid() error {
return err
}
if err := statement.Actions.Validate(); err != nil {
return err
}
for action := range statement.Actions {
if !statement.Resources.objectResourceExists() && !statement.Resources.bucketResourceExists() {
return Errorf("unsupported Resource found %v for action %v", statement.Resources, action)
@@ -114,38 +124,6 @@ func (statement Statement) isValid() error {
return nil
}
// MarshalJSON - encodes JSON data to Statement.
func (statement Statement) MarshalJSON() ([]byte, error) {
if err := statement.isValid(); err != nil {
return nil, err
}
// subtype to avoid recursive call to MarshalJSON()
type subStatement Statement
ss := subStatement(statement)
return json.Marshal(ss)
}
// UnmarshalJSON - decodes JSON data to Statement.
func (statement *Statement) UnmarshalJSON(data []byte) error {
// subtype to avoid recursive call to UnmarshalJSON()
type subStatement Statement
var ss subStatement
if err := json.Unmarshal(data, &ss); err != nil {
return err
}
s := Statement(ss)
if err := s.isValid(); err != nil {
return err
}
*statement = s
return nil
}
// Validate - validates Statement is for given bucket or not.
func (statement Statement) Validate() error {
return statement.isValid()