MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-07-08 16:42:17 -04:00
Code Issues Packages Projects Releases Wiki Activity

allow JWT parsing on large session policy based tokens (#17167)

Browse Source
This commit is contained in:
Harshavardhana 2023-05-09 00:53:08 -07:00 committed by GitHub
parent 57acacd5a7
commit a7f266c907
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 19 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/admin-handler-utils.go
View File

@ -168,10 +168,16 @@ func toAdminAPIErr(ctx context.Context, err error) APIError {
} }
case errors.Is(err, errPolicyInUse): case errors.Is(err, errPolicyInUse):
apiErr = APIError{ apiErr = APIError{
Code: "XMinioAdminPolicyInUse", Code: "XMinioIAMPolicyInUse",
Description: "The policy cannot be removed, as it is in use", Description: "The policy cannot be removed, as it is in use",
HTTPStatusCode: http.StatusBadRequest, HTTPStatusCode: http.StatusBadRequest,
} }
case errors.Is(err, errSessionPolicyTooLarge):
apiErr = APIError{
Code: "XMinioIAMServiceAccountSessionPolicyTooLarge",
Description: err.Error(),
HTTPStatusCode: http.StatusBadRequest,
}
case errors.Is(err, kes.ErrKeyExists): case errors.Is(err, kes.ErrKeyExists):
apiErr = APIError{ apiErr = APIError{
Code: "XMinioKMSKeyExists", Code: "XMinioKMSKeyExists",

9
cmd/iam-store.go
View File

@ -27,7 +27,6 @@ import (
"strings" "strings"
"time" "time"
"github.com/dustin/go-humanize"
jsoniter "github.com/json-iterator/go" jsoniter "github.com/json-iterator/go"
"github.com/minio/madmin-go/v2" "github.com/minio/madmin-go/v2"
"github.com/minio/minio-go/v7/pkg/set" "github.com/minio/minio-go/v7/pkg/set"
@ -2221,13 +2220,13 @@ func (store *IAMStoreSys) UpdateServiceAccount(ctx context.Context, accessKey st
delete(m, sessionPolicyNameExtracted) delete(m, sessionPolicyNameExtracted)
// sessionPolicy is nil and there is embedded policy attached we remove // sessionPolicy is nil and there is embedded policy attached we remove
// rembedded policy at that point. // embedded policy at that point.
if _, ok := m[iampolicy.SessionPolicyName]; ok && opts.sessionPolicy == nil { if _, ok := m[iampolicy.SessionPolicyName]; ok && opts.sessionPolicy == nil {
delete(m, iampolicy.SessionPolicyName) delete(m, iampolicy.SessionPolicyName)
m[iamPolicyClaimNameSA()] = inheritedPolicyType m[iamPolicyClaimNameSA()] = inheritedPolicyType
} }
if opts.sessionPolicy != nil { if opts.sessionPolicy != nil { // session policies is being updated
if err := opts.sessionPolicy.Validate(); err != nil { if err := opts.sessionPolicy.Validate(); err != nil {
return updatedAt, err return updatedAt, err
} }
@ -2237,8 +2236,8 @@ func (store *IAMStoreSys) UpdateServiceAccount(ctx context.Context, accessKey st
return updatedAt, err return updatedAt, err
} }
if len(policyBuf) > 16*humanize.KiByte { if len(policyBuf) > 2048 {
return updatedAt, fmt.Errorf("Session policy should not exceed 16 KiB characters") return updatedAt, errSessionPolicyTooLarge
} }
// Overwrite session policy claims. // Overwrite session policy claims.

5
cmd/iam.go
View File

@ -32,7 +32,6 @@ import (
"sync/atomic" "sync/atomic"
"time" "time"
humanize "github.com/dustin/go-humanize"
"github.com/minio/madmin-go/v2" "github.com/minio/madmin-go/v2"
"github.com/minio/minio-go/v7/pkg/set" "github.com/minio/minio-go/v7/pkg/set"
"github.com/minio/minio/internal/arn" "github.com/minio/minio/internal/arn"
@ -944,8 +943,8 @@ func (sys *IAMSys) NewServiceAccount(ctx context.Context, parentUser string, gro
if err != nil { if err != nil {
return auth.Credentials{}, time.Time{}, err return auth.Credentials{}, time.Time{}, err
} }
if len(policyBuf) > 16*humanize.KiByte { if len(policyBuf) > 2048 {
return auth.Credentials{}, time.Time{}, fmt.Errorf("Session policy should not exceed 16 KiB characters") return auth.Credentials{}, time.Time{}, errSessionPolicyTooLarge
} }
} }

2
cmd/sts-handlers.go
View File

@ -238,7 +238,7 @@ func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
// The plain text that you use for both inline and managed session // The plain text that you use for both inline and managed session
// policies shouldn't exceed 2048 characters. // policies shouldn't exceed 2048 characters.
if len(sessionPolicyStr) > 2048 { if len(sessionPolicyStr) > 2048 {
writeSTSErrorResponse(ctx, w, ErrSTSInvalidParameterValue, fmt.Errorf("Session policy shouldn't exceed 2048 characters")) writeSTSErrorResponse(ctx, w, ErrSTSInvalidParameterValue, errSessionPolicyTooLarge)
return return
} }

3
cmd/typed-errors.go
View File

@ -115,3 +115,6 @@ var errUploadIDNotFound = errors.New("Specified Upload ID is not found")
// error returned when PartNumber is greater than the maximum allowed 10000 parts // error returned when PartNumber is greater than the maximum allowed 10000 parts
var errInvalidMaxParts = errors.New("Part number is greater than the maximum allowed 10000 parts") var errInvalidMaxParts = errors.New("Part number is greater than the maximum allowed 10000 parts")
// error returned for session policies > 2048
var errSessionPolicyTooLarge = errors.New("Session policy should not exceed 2048 characters")

3
internal/jwt/parser.go
View File

@ -34,6 +34,7 @@ import (
"time" "time"
"github.com/buger/jsonparser" "github.com/buger/jsonparser"
"github.com/dustin/go-humanize"
jwtgo "github.com/golang-jwt/jwt/v4" jwtgo "github.com/golang-jwt/jwt/v4"
jsoniter "github.com/json-iterator/go" jsoniter "github.com/json-iterator/go"
) )
@ -53,7 +54,7 @@ var (
SigningMethodHS512 *SigningMethodHMAC SigningMethodHS512 *SigningMethodHMAC
) )
const base64BufferSize = 8192 const base64BufferSize = 64 * humanize.KiByte
var ( var (
base64BufPool sync.Pool base64BufPool sync.Pool