Jian Qiu f56e2327b1 fix(s3gateway): enforce signature freshness and single key decoding (#25490) ...

- Reject signed requests older or newer than 15 minutes (x-amz-date
  for v4, Date for v2), so intercepted valid requests can no longer
  be replayed indefinitely
- Decode the object key exactly once: r.URL.Path is already decoded
  by net/http and is the form the signature covers, decoding again
  let a signature for one key be replayed against another
  (e.g. %252e%252e%252f resolving to ../)
- Add unit tests for both behaviors

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-09-04 09:19:43 +08:00

..

handlers

fix(s3gateway): enforce signature freshness and single key decoding (#25490)

2026-09-04 09:19:43 +08:00

models

fix: remove mutual dependency of cloudmux on onecloud (#15621)

2022-12-27 01:21:26 +08:00

options

feature: 1. ak/sk auth support 2. a full feature s3gateway works with

2019-08-30 00:12:39 +08:00

service

feat(misc): use cloudmux package (#15254)

2022-10-28 19:53:03 +08:00

session

fix: remove apiversion param from session

2022-08-25 09:43:50 +08:00