realloc/frostfs-node
1
0
Fork 0
forked from TrueCloudLab/frostfs-node
Code Releases Packages Activity

[#1386] services/object: Fail eACL check if the request is invalid

Browse source 
Parse all headers beforehand and reject invalid requests.
Another approach would be to remember the error and check
it after `CalculateAction`, which is a bit faster.
The rule of thumb here is "first validate, then use".

Signed-off-by: Evgenii Stratonikov <evgeniy@nspcc.ru>
This commit is contained in:
Evgenii Stratonikov 2022-05-17 15:46:25 +03:00 • committed by LeL
parent f99a0498da
commit 3f4475f97b
3 changed files with 55 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

9
pkg/services/object/acl/acl.go
View file

@ -187,14 +187,17 @@ func (c *Checker) CheckEACL(msg interface{}, reqInfo v2.RequestInfo) error {
)
}
hdrSrc, err := eaclV2.NewMessageHeaderSource(hdrSrcOpts...)
if err != nil {
return fmt.Errorf("can't parse headers: %w", err)
}
action := c.validator.CalculateAction(new(eaclSDK.ValidationUnit).
WithRole(reqInfo.RequestRole()).
WithOperation(reqInfo.Operation()).
WithContainerID(reqInfo.ContainerID()).
WithSenderKey(reqInfo.SenderKey()).
WithHeaderSource(
eaclV2.NewMessageHeaderSource(hdrSrcOpts...),
).
WithHeaderSource(hdrSrc).
WithEACLTable(&table),
)