kopia lustrzana https://github.com/gaul/s3proxy
fix time skew validation for presigned urls
rodzic
96d82c681a
commit
a3e6f47cfc
|
@ -462,7 +462,7 @@ public class S3ProxyHandler {
|
|||
haveDate = false;
|
||||
}
|
||||
if (haveDate) {
|
||||
isTimeSkewed(dateSkew);
|
||||
isTimeSkewed(dateSkew, presignedUrl);
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -2945,14 +2945,22 @@ public class S3ProxyHandler {
|
|||
}
|
||||
}
|
||||
|
||||
private void isTimeSkewed(long date) throws S3Exception {
|
||||
private void isTimeSkewed(
|
||||
long date, boolean isPresigned) throws S3Exception {
|
||||
if (date < 0) {
|
||||
throw new S3Exception(S3ErrorCode.ACCESS_DENIED);
|
||||
}
|
||||
long now = System.currentTimeMillis() / 1000;
|
||||
if (now + maximumTimeSkew < date || now - maximumTimeSkew > date) {
|
||||
logger.debug("time skewed {} {}", date, now);
|
||||
throw new S3Exception(S3ErrorCode.REQUEST_TIME_TOO_SKEWED);
|
||||
if (isPresigned) {
|
||||
if (now + maximumTimeSkew < date) {
|
||||
logger.debug("request is not valid yet {} {}", date, now);
|
||||
throw new S3Exception(S3ErrorCode.ACCESS_DENIED);
|
||||
}
|
||||
} else {
|
||||
if (now + maximumTimeSkew < date || now - maximumTimeSkew > date) {
|
||||
logger.debug("time skewed {} {}", date, now);
|
||||
throw new S3Exception(S3ErrorCode.REQUEST_TIME_TOO_SKEWED);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Ładowanie…
Reference in New Issue