MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-12-06 07:42:32 -05:00
Code Issues Packages Projects Releases Wiki Activity

[sec] Match ${aws:username} exactly instead of prefix match (#7791)

Browse Source 
This PR fixes a security issue where an IAM user based
on his policy is granted more privileges than restricted
by the users IAM policy.

This is due to an issue of prefix based Matcher() function
which was incorrectly matching prefix based on resource
prefixes instead of exact match.
This commit is contained in:
Harshavardhana
2019-06-15 11:27:17 -07:00
committed by kannappanr
parent 7b8beecc81
commit 99bf4d0c42
5 changed files with 23 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
go.mod
View File

@@ -21,6 +21,7 @@ require (
github.com/djherbis/atime v1.0.0
github.com/dnaeon/go-vcr v1.0.1 // indirect
github.com/dustin/go-humanize v1.0.0
github.com/eapache/go-resiliency v1.2.0 // indirect
github.com/eclipse/paho.mqtt.golang v1.1.2-0.20190322152051-20337d8c3947
github.com/elazarl/go-bindata-assetfs v1.0.0
github.com/fatih/color v1.7.0
@@ -89,10 +90,8 @@ require (
go.etcd.io/bbolt v1.3.3 // indirect
go.uber.org/atomic v1.3.2
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8
golang.org/x/lint v0.0.0-20190409202823-959b441ac422 // indirect
golang.org/x/net v0.0.0-20190611141213-3f473d35a33a // indirect
golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae
golang.org/x/tools v0.0.0-20190612232758-d4e310b4a8a5 // indirect
google.golang.org/api v0.4.0
gopkg.in/Shopify/sarama.v1 v1.20.0
gopkg.in/olivere/elastic.v5 v5.0.80