123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276 |
- package policy
- import (
- "encoding/json"
- "errors"
- "fmt"
- "net/http"
- "reflect"
- "strconv"
- "strings"
- "time"
- )
- var startsWithConds = map[string]bool{
- "$acl": true,
- "$bucket": false,
- "$cache-control": true,
- "$content-type": true,
- "$content-disposition": true,
- "$content-encoding": true,
- "$expires": true,
- "$key": true,
- "$success_action_redirect": true,
- "$redirect": true,
- "$success_action_status": false,
- "$x-amz-algorithm": false,
- "$x-amz-credential": false,
- "$x-amz-date": false,
- }
- const (
- policyCondEqual = "eq"
- policyCondStartsWith = "starts-with"
- policyCondContentLength = "content-length-range"
- )
- func toString(val interface{}) string {
- switch v := val.(type) {
- case string:
- return v
- default:
- return ""
- }
- }
- func toLowerString(val interface{}) string {
- return strings.ToLower(toString(val))
- }
- func toInteger(val interface{}) (int64, error) {
- switch v := val.(type) {
- case float64:
- return int64(v), nil
- case int64:
- return v, nil
- case int:
- return int64(v), nil
- case string:
- i, err := strconv.Atoi(v)
- return int64(i), err
- default:
- return 0, errors.New("Invalid number format")
- }
- }
- func isString(val interface{}) bool {
- _, ok := val.(string)
- return ok
- }
- type contentLengthRange struct {
- Min int64
- Max int64
- Valid bool
- }
- type PostPolicyForm struct {
- Expiration time.Time
- Conditions struct {
- Policies []struct {
- Operator string
- Key string
- Value string
- }
- ContentLengthRange contentLengthRange
- }
- }
- func ParsePostPolicyForm(policy string) (ppf PostPolicyForm, e error) {
-
-
- var rawPolicy struct {
- Expiration string `json:"expiration"`
- Conditions []interface{} `json:"conditions"`
- }
- err := json.Unmarshal([]byte(policy), &rawPolicy)
- if err != nil {
- return ppf, err
- }
- parsedPolicy := PostPolicyForm{}
-
- parsedPolicy.Expiration, err = time.Parse(time.RFC3339Nano, rawPolicy.Expiration)
- if err != nil {
- return ppf, err
- }
-
- for _, val := range rawPolicy.Conditions {
- switch condt := val.(type) {
- case map[string]interface{}:
- for k, v := range condt {
- if !isString(v) {
-
- return parsedPolicy, fmt.Errorf("Unknown type %s of conditional field value %s found in POST policy form", reflect.TypeOf(condt).String(), condt)
- }
-
-
- parsedPolicy.Conditions.Policies = append(parsedPolicy.Conditions.Policies, struct {
- Operator string
- Key string
- Value string
- }{
- policyCondEqual, "$" + strings.ToLower(k), toString(v),
- })
- }
- case []interface{}:
- if len(condt) != 3 {
- return parsedPolicy, fmt.Errorf("Malformed conditional fields %s of type %s found in POST policy form", condt, reflect.TypeOf(condt).String())
- }
- switch toLowerString(condt[0]) {
- case policyCondEqual, policyCondStartsWith:
- for _, v := range condt {
- if !isString(v) {
-
- return parsedPolicy, fmt.Errorf("Unknown type %s of conditional field value %s found in POST policy form", reflect.TypeOf(condt).String(), condt)
- }
- }
- operator, matchType, value := toLowerString(condt[0]), toLowerString(condt[1]), toString(condt[2])
- if !strings.HasPrefix(matchType, "$") {
- return parsedPolicy, fmt.Errorf("Invalid according to Policy: Policy Condition failed: [%s, %s, %s]", operator, matchType, value)
- }
- parsedPolicy.Conditions.Policies = append(parsedPolicy.Conditions.Policies, struct {
- Operator string
- Key string
- Value string
- }{
- operator, matchType, value,
- })
- case policyCondContentLength:
- min, err := toInteger(condt[1])
- if err != nil {
- return parsedPolicy, err
- }
- max, err := toInteger(condt[2])
- if err != nil {
- return parsedPolicy, err
- }
- parsedPolicy.Conditions.ContentLengthRange = contentLengthRange{
- Min: min,
- Max: max,
- Valid: true,
- }
- default:
-
- return parsedPolicy, fmt.Errorf("Unknown type %s of conditional field value %s found in POST policy form",
- reflect.TypeOf(condt).String(), condt)
- }
- default:
- return parsedPolicy, fmt.Errorf("Unknown field %s of type %s found in POST policy form",
- condt, reflect.TypeOf(condt).String())
- }
- }
- return parsedPolicy, nil
- }
- func checkPolicyCond(op string, input1, input2 string) bool {
- switch op {
- case policyCondEqual:
- return input1 == input2
- case policyCondStartsWith:
- return strings.HasPrefix(input1, input2)
- }
- return false
- }
- func CheckPostPolicy(formValues http.Header, postPolicyForm PostPolicyForm) error {
-
- if !postPolicyForm.Expiration.After(time.Now().UTC()) {
- return fmt.Errorf("Invalid according to Policy: Policy expired")
- }
-
- metaMap := make(map[string]string)
- for _, policy := range postPolicyForm.Conditions.Policies {
- if strings.HasPrefix(policy.Key, "$x-amz-meta-") {
- formCanonicalName := http.CanonicalHeaderKey(strings.TrimPrefix(policy.Key, "$"))
- metaMap[formCanonicalName] = policy.Value
- }
- }
-
- for key := range formValues {
- if strings.HasPrefix(key, "X-Amz-Meta-") {
- if _, ok := metaMap[key]; !ok {
- return fmt.Errorf("Invalid according to Policy: Extra input fields: %s", key)
- }
- }
- }
-
- var condPassed bool
-
- for _, policy := range postPolicyForm.Conditions.Policies {
-
-
- formCanonicalName := http.CanonicalHeaderKey(strings.TrimPrefix(policy.Key, "$"))
-
- op := policy.Operator
-
- if startsWithSupported, condFound := startsWithConds[policy.Key]; condFound {
-
- if op == policyCondStartsWith && !startsWithSupported {
- return fmt.Errorf("Invalid according to Policy: Policy Condition failed")
- }
-
- condPassed = checkPolicyCond(op, formValues.Get(formCanonicalName), policy.Value)
- if !condPassed {
- return fmt.Errorf("Invalid according to Policy: Policy Condition failed")
- }
- } else {
-
- if strings.HasPrefix(policy.Key, "$x-amz-meta-") || strings.HasPrefix(policy.Key, "$x-amz-") {
-
- condPassed = checkPolicyCond(op, formValues.Get(formCanonicalName), policy.Value)
- if !condPassed {
- return fmt.Errorf("Invalid according to Policy: Policy Condition failed: [%s, %s, %s]", op, policy.Key, policy.Value)
- }
- }
- }
- }
- return nil
- }
|