From 893a0eea57a44bb2eaa8493612c7ad323adb3efc Mon Sep 17 00:00:00 2001
From: guosj <515878133@qq.com>
Date: Fri, 22 Apr 2022 22:47:11 +0800
Subject: [PATCH 1/2] add more checks and comments

---
 weed/iamapi/iamapi_management_handlers.go | 28 +++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/weed/iamapi/iamapi_management_handlers.go b/weed/iamapi/iamapi_management_handlers.go
index 5fea49f5c..3ba2590b0 100644
--- a/weed/iamapi/iamapi_management_handlers.go
+++ b/weed/iamapi/iamapi_management_handlers.go
@@ -382,11 +382,31 @@ func (iama *IamApiServer) DeleteAccessKey(s3cfg *iam_pb.S3ApiConfiguration, valu
 // "If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web
 // Services access key ID signing the request."
 func handleImplicitUsername(r *http.Request, values url.Values) {
-	if values.Get("UserName") == "" {
-		// get username who signs the request
-		userName := strings.Split(r.Header["Authorization"][0], "/")[2]
-		values.Set("UserName", userName)
+	if len(r.Header["Authorization"]) == 0 || values.Get("UserName") != "" {
+		return
+	}
+	// get username who signs the request
+	// for a typical Authorization:
+	// "AWS4-HMAC-SHA256 Credential=197FSAQ7HHTA48X64O3A/20220420/test1/iam/aws4_request, SignedHeaders=content-type;
+	// host;x-amz-date, Signature=6757dc6b3d7534d67e17842760310e99ee695408497f6edc4fdb84770c252dc8"
+	// the "test1" will be extracted as the username
+	s := strings.Split(r.Header["Authorization"][0], "Credential=")
+	if len(s) < 2 {
+		return
+	}
+	glog.V(6).Infof("s: %v\n", s)
+	s = strings.Split(s[1], ",")
+	if len(s) < 2 {
+		return
+	}
+	glog.V(6).Infof("s: %v\n", s)
+	s = strings.Split(s[0], "/")
+	if len(s) < 5 {
+		return
 	}
+	glog.V(6).Infof("s: %v\n", s)
+	userName := s[2]
+	values.Set("UserName", userName)
 }
 
 func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {

From 8fd7b24b80e7706741dc26d873a656a5d3555a4d Mon Sep 17 00:00:00 2001
From: guosj <515878133@qq.com>
Date: Sun, 24 Apr 2022 16:09:10 +0800
Subject: [PATCH 2/2] remove redundant logs & add unit test

---
 weed/iamapi/iamapi_management_handlers.go |  4 ----
 weed/iamapi/iamapi_test.go                | 22 ++++++++++++++++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/weed/iamapi/iamapi_management_handlers.go b/weed/iamapi/iamapi_management_handlers.go
index fedc837d6..488e92aa5 100644
--- a/weed/iamapi/iamapi_management_handlers.go
+++ b/weed/iamapi/iamapi_management_handlers.go
@@ -394,19 +394,15 @@ func handleImplicitUsername(r *http.Request, values url.Values) {
 	if len(s) < 2 {
 		return
 	}
-	glog.V(4).Infof("First strip: %v", s)
 	s = strings.Split(s[1], ",")
 	if len(s) < 2 {
 		return
 	}
-	glog.V(4).Infof("Second strip: %v", s)
 	s = strings.Split(s[0], "/")
 	if len(s) < 5 {
 		return
 	}
-	glog.V(4).Infof("Third strip: %v", s)
 	userName := s[2]
-	glog.V(4).Infof("UserName: %v", userName)
 	values.Set("UserName", userName)
 }
 
diff --git a/weed/iamapi/iamapi_test.go b/weed/iamapi/iamapi_test.go
index 5b21e4293..375e9a2f3 100644
--- a/weed/iamapi/iamapi_test.go
+++ b/weed/iamapi/iamapi_test.go
@@ -4,6 +4,7 @@ import (
 	"encoding/xml"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -192,3 +193,24 @@ func executeRequest(req *http.Request, v interface{}) (*httptest.ResponseRecorde
 	apiRouter.ServeHTTP(rr, req)
 	return rr, xml.Unmarshal(rr.Body.Bytes(), &v)
 }
+
+func TestHandleImplicitUsername(t *testing.T) {
+	var tests = []struct {
+		r        *http.Request
+		values   url.Values
+		userName string
+	}{
+		{&http.Request{}, url.Values{}, ""},
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=197FSAQ7HHTA48X64O3A/20220420/test1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=6757dc6b3d7534d67e17842760310e99ee695408497f6edc4fdb84770c252dc8"}}}, url.Values{}, "test1"},
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 =197FSAQ7HHTA48X64O3A/20220420/test1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=6757dc6b3d7534d67e17842760310e99ee695408497f6edc4fdb84770c252dc8"}}}, url.Values{}, ""},
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=197FSAQ7HHTA48X64O3A/20220420/test1/iam/aws4_request SignedHeaders=content-type;host;x-amz-date Signature=6757dc6b3d7534d67e17842760310e99ee695408497f6edc4fdb84770c252dc8"}}}, url.Values{}, ""},
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=197FSAQ7HHTA48X64O3A/20220420/test1/iam, SignedHeaders=content-type;host;x-amz-date, Signature=6757dc6b3d7534d67e17842760310e99ee695408497f6edc4fdb84770c252dc8"}}}, url.Values{}, ""},
+	}
+
+	for i, test := range tests {
+		handleImplicitUsername(test.r, test.values)
+		if un := test.values.Get("UserName"); un != test.userName {
+			t.Errorf("No.%d: Got: %v, Expected: %v", i, un, test.userName)
+		}
+	}
+}