From eb054eb1f7d49b9c245ed9dbb801c7b14afd0ea6 Mon Sep 17 00:00:00 2001 From: chrislu Date: Fri, 21 Nov 2025 13:23:52 -0800 Subject: [PATCH] err on duplicated tag key --- weed/s3api/s3_metadata_util.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/weed/s3api/s3_metadata_util.go b/weed/s3api/s3_metadata_util.go index b9b1b921d..37363752a 100644 --- a/weed/s3api/s3_metadata_util.go +++ b/weed/s3api/s3_metadata_util.go @@ -43,12 +43,17 @@ func ParseS3Metadata(r *http.Request, existing map[string][]byte, isReplace bool glog.Warningf("Invalid S3 tag format in header '%s': %v", tags, err) return nil, s3err.ErrInvalidTag } + + // Validate: S3 spec does not allow duplicate tag keys for key, values := range parsedTags { - // According to S3 spec, if a key is provided multiple times, the last value is used. - // A tag value can be an empty string but not nil. + if len(values) > 1 { + glog.Warningf("Duplicate tag key '%s' in header '%s'", key, tags) + return nil, s3err.ErrInvalidTag + } + // Tag value can be an empty string but not nil value := "" if len(values) > 0 { - value = values[len(values)-1] + value = values[0] } metadata[s3_constants.AmzObjectTagging+"-"+key] = []byte(value) }