Harshavardhana 726d80dbb7 fix: merge duplicate keys in post policy (#11843) ...

some SDKs might incorrectly send duplicate
entries for keys such as "conditions", Go
stdlib unmarshal for JSON does not support
duplicate keys - instead skips the first
duplicate and only preserves the last entry.

This can lead to issues where a policy JSON
while being valid might not properly apply
the required conditions, allowing situations
where POST policy JSON would end up allowing
uploads to unauthorized buckets and paths.

This PR fixes this properly.

2021-03-20 22:16:30 -07:00

7.7 KiB

Raw Blame History

View Raw