|
|
@ -275,14 +275,10 @@ func (s3a *S3ApiServer) validateBucketPolicy(policyDoc *policy.PolicyDocument, b |
|
|
// validateResourceForBucket checks if a resource ARN is valid for the given bucket
|
|
|
// validateResourceForBucket checks if a resource ARN is valid for the given bucket
|
|
|
func (s3a *S3ApiServer) validateResourceForBucket(resource, bucket string) bool { |
|
|
func (s3a *S3ApiServer) validateResourceForBucket(resource, bucket string) bool { |
|
|
// Accepted formats for S3 bucket policies:
|
|
|
// Accepted formats for S3 bucket policies:
|
|
|
// AWS-style ARNs (recommended):
|
|
|
|
|
|
|
|
|
// AWS-style ARNs (standard):
|
|
|
// arn:aws:s3:::bucket-name
|
|
|
// arn:aws:s3:::bucket-name
|
|
|
// arn:aws:s3:::bucket-name/*
|
|
|
// arn:aws:s3:::bucket-name/*
|
|
|
// arn:aws:s3:::bucket-name/path/to/object
|
|
|
// arn:aws:s3:::bucket-name/path/to/object
|
|
|
// Legacy SeaweedFS ARNs (supported for backward compatibility):
|
|
|
|
|
|
// arn:seaweed:s3:::bucket-name
|
|
|
|
|
|
// arn:seaweed:s3:::bucket-name/*
|
|
|
|
|
|
// arn:seaweed:s3:::bucket-name/path/to/object
|
|
|
|
|
|
// Simplified formats (for convenience):
|
|
|
// Simplified formats (for convenience):
|
|
|
// bucket-name
|
|
|
// bucket-name
|
|
|
// bucket-name/*
|
|
|
// bucket-name/*
|
|
|
@ -290,13 +286,10 @@ func (s3a *S3ApiServer) validateResourceForBucket(resource, bucket string) bool |
|
|
|
|
|
|
|
|
var resourcePath string |
|
|
var resourcePath string |
|
|
const awsPrefix = "arn:aws:s3:::" |
|
|
const awsPrefix = "arn:aws:s3:::" |
|
|
const seaweedPrefix = "arn:seaweed:s3:::" |
|
|
|
|
|
|
|
|
|
|
|
// Strip the optional ARN prefix to get the resource path
|
|
|
// Strip the optional ARN prefix to get the resource path
|
|
|
if path, ok := strings.CutPrefix(resource, awsPrefix); ok { |
|
|
if path, ok := strings.CutPrefix(resource, awsPrefix); ok { |
|
|
resourcePath = path |
|
|
resourcePath = path |
|
|
} else if path, ok := strings.CutPrefix(resource, seaweedPrefix); ok { |
|
|
|
|
|
resourcePath = path |
|
|
|
|
|
} else { |
|
|
} else { |
|
|
resourcePath = resource |
|
|
resourcePath = resource |
|
|
} |
|
|
} |
|
|
|