fix time skew validation for presigned urls

pull/678/head
Timur Saikaliev 2024-06-19 00:11:58 +03:00 zatwierdzone przez Andrew Gaul
rodzic 96d82c681a
commit a3e6f47cfc
1 zmienionych plików z 13 dodań i 5 usunięć

Wyświetl plik

@ -462,7 +462,7 @@ public class S3ProxyHandler {
haveDate = false; haveDate = false;
} }
if (haveDate) { if (haveDate) {
isTimeSkewed(dateSkew); isTimeSkewed(dateSkew, presignedUrl);
} }
} }
@ -2945,14 +2945,22 @@ public class S3ProxyHandler {
} }
} }
private void isTimeSkewed(long date) throws S3Exception { private void isTimeSkewed(
long date, boolean isPresigned) throws S3Exception {
if (date < 0) { if (date < 0) {
throw new S3Exception(S3ErrorCode.ACCESS_DENIED); throw new S3Exception(S3ErrorCode.ACCESS_DENIED);
} }
long now = System.currentTimeMillis() / 1000; long now = System.currentTimeMillis() / 1000;
if (now + maximumTimeSkew < date || now - maximumTimeSkew > date) { if (isPresigned) {
logger.debug("time skewed {} {}", date, now); if (now + maximumTimeSkew < date) {
throw new S3Exception(S3ErrorCode.REQUEST_TIME_TOO_SKEWED); logger.debug("request is not valid yet {} {}", date, now);
throw new S3Exception(S3ErrorCode.ACCESS_DENIED);
}
} else {
if (now + maximumTimeSkew < date || now - maximumTimeSkew > date) {
logger.debug("time skewed {} {}", date, now);
throw new S3Exception(S3ErrorCode.REQUEST_TIME_TOO_SKEWED);
}
} }
} }