forked from TrueCloudLab/frostfs-node
e54b52ec03
In previous implementation of `neofs-node` app object session was not checked for substitution of the object related to it. Also, for access checks, the session object was substituted instead of the one from the request. This, on the one hand, made it possible to inherit the session from the parent object for authorization for certain actions. On the other hand, it covered the mentioned object substitution, which is a critical vulnerability. Next changes are applied to processing of all Object service requests: - check if object session relates to the requested object - use requested object in access checks. Disclosed problem of object context inheritance will be solved within Signed-off-by: Leonard Lyubich <ctulhurider@gmail.com>
99 lines
4.4 KiB
Modula-2
99 lines
4.4 KiB
Modula-2
module github.com/nspcc-dev/neofs-node
|
|
|
|
go 1.17
|
|
|
|
require (
|
|
github.com/cheggaaa/pb v1.0.29
|
|
github.com/chzyer/readline v1.5.1
|
|
github.com/flynn-archive/go-shlex v0.0.0-20150515145356-3f9db97f8568
|
|
github.com/google/go-github/v39 v39.2.0
|
|
github.com/google/uuid v1.3.0
|
|
github.com/hashicorp/golang-lru v0.5.4
|
|
github.com/klauspost/compress v1.15.9
|
|
github.com/mitchellh/go-homedir v1.1.0
|
|
github.com/mr-tron/base58 v1.2.0
|
|
github.com/multiformats/go-multiaddr v0.4.0
|
|
github.com/nats-io/nats.go v1.16.0
|
|
github.com/nspcc-dev/hrw v1.0.9
|
|
github.com/nspcc-dev/neo-go v0.99.2
|
|
github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20220809123759-3094d3e0c14b // indirect
|
|
github.com/nspcc-dev/neofs-api-go/v2 v2.13.2-0.20221004142957-5fc2644c680d
|
|
github.com/nspcc-dev/neofs-contract v0.15.5-0.20220930133158-d95bc535894c
|
|
github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.6.0.20221005093951-1325b4f27218
|
|
github.com/nspcc-dev/tzhash v1.6.1
|
|
github.com/panjf2000/ants/v2 v2.4.0
|
|
github.com/paulmach/orb v0.2.2
|
|
github.com/prometheus/client_golang v1.13.0
|
|
github.com/spf13/cast v1.5.0
|
|
github.com/spf13/cobra v1.5.0
|
|
github.com/spf13/pflag v1.0.5
|
|
github.com/spf13/viper v1.12.0
|
|
github.com/stretchr/testify v1.7.2
|
|
go.etcd.io/bbolt v1.3.6
|
|
go.uber.org/atomic v1.9.0
|
|
go.uber.org/zap v1.21.0
|
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
|
|
google.golang.org/grpc v1.48.0
|
|
google.golang.org/protobuf v1.28.1
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
|
|
github.com/benbjohnson/clock v1.1.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/btcsuite/btcd v0.22.0-beta // indirect
|
|
github.com/cespare/xxhash/v2 v2.1.2 // indirect
|
|
github.com/coreos/go-semver v0.3.0 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/fsnotify/fsnotify v1.5.4 // indirect
|
|
github.com/golang/protobuf v1.5.2 // indirect
|
|
github.com/golang/snappy v0.0.3 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/gorilla/websocket v1.4.2 // indirect
|
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
github.com/holiman/uint256 v1.2.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.0.0 // indirect
|
|
github.com/ipfs/go-cid v0.0.7 // indirect
|
|
github.com/magiconair/properties v1.8.6 // indirect
|
|
github.com/mattn/go-runewidth v0.0.4 // indirect
|
|
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
|
|
github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 // indirect
|
|
github.com/minio/sha256-simd v0.1.1-0.20190913151208-6de447530771 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/multiformats/go-base32 v0.0.3 // indirect
|
|
github.com/multiformats/go-base36 v0.1.0 // indirect
|
|
github.com/multiformats/go-multibase v0.0.3 // indirect
|
|
github.com/multiformats/go-multihash v0.0.14 // indirect
|
|
github.com/multiformats/go-varint v0.0.6 // indirect
|
|
github.com/nats-io/nats-server/v2 v2.7.4 // indirect
|
|
github.com/nats-io/nkeys v0.3.0 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/nspcc-dev/go-ordered-json v0.0.0-20220111165707-25110be27d22 // indirect
|
|
github.com/nspcc-dev/neofs-crypto v0.4.0 // indirect
|
|
github.com/nspcc-dev/rfc6979 v0.2.0 // indirect
|
|
github.com/pelletier/go-toml v1.9.5 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.2 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/client_model v0.2.0 // indirect
|
|
github.com/prometheus/common v0.37.0 // indirect
|
|
github.com/prometheus/procfs v0.8.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/spaolacci/murmur3 v1.1.0 // indirect
|
|
github.com/spf13/afero v1.9.2 // indirect
|
|
github.com/spf13/jwalterweatherman v1.1.0 // indirect
|
|
github.com/subosito/gotenv v1.4.0 // indirect
|
|
github.com/syndtr/goleveldb v1.0.1-0.20210305035536-64b5b1c73954 // indirect
|
|
github.com/twmb/murmur3 v1.1.5 // indirect
|
|
github.com/urfave/cli v1.22.5 // indirect
|
|
go.uber.org/multierr v1.8.0 // indirect
|
|
golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
|
|
golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
|
|
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 // indirect
|
|
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect
|
|
golang.org/x/text v0.3.7 // indirect
|
|
google.golang.org/genproto v0.0.0-20220722212130-b98a9ff5e252 // indirect
|
|
gopkg.in/ini.v1 v1.66.6 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
)
|