Skip to content

Commit

Permalink
Use automatic URI encoding (#3352)
Browse files Browse the repository at this point in the history
  • Loading branch information
@ramondeklein
ramondeklein authored Jun 5, 2024
1 parent 72939e0 commit 49c5f5a
Show file tree
Hide file tree
Showing 67 changed files with 398 additions and 875 deletions.
2 changes: 1 addition & 1 deletion Makefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ swagger-console:
@echo "Generating swagger server code from yaml"
@swagger generate server -A console --main-package=management --server-package=api --exclude-main -P models.Principal -f ./swagger.yml -r NOTICE
@echo "Generating typescript api"
@npx swagger-typescript-api -p ./swagger.yml -o ./web-app/src/api -n consoleApi.ts
@npx swagger-typescript-api -p ./swagger.yml -o ./web-app/src/api -n consoleApi.ts --custom-config generator.config.js
@git restore api/server.go


Expand Down
22 changes: 3 additions & 19 deletions api/admin_groups.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ import (
"github.com/go-openapi/errors"
"github.com/go-openapi/runtime/middleware"
"github.com/minio/console/api/operations"
"github.com/minio/console/pkg/utils"
"github.com/minio/madmin-go/v3"

groupApi "github.com/minio/console/api/operations/group"
Expand Down Expand Up @@ -118,12 +117,7 @@ func getGroupInfoResponse(session *models.Principal, params groupApi.GroupInfoPa
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}

groupName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}

groupDesc, err := groupInfo(ctx, adminClient, groupName)
groupDesc, err := groupInfo(ctx, adminClient, params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
Expand Down Expand Up @@ -212,12 +206,7 @@ func getRemoveGroupResponse(session *models.Principal, params groupApi.RemoveGro
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}

groupName, err := utils.DecodeBase64(params.Name)
if err != nil {
return ErrorWithContext(ctx, err)
}

if err := removeGroup(ctx, adminClient, groupName); err != nil {
if err := removeGroup(ctx, adminClient, params.Name); err != nil {
minioError := madmin.ToErrorResponse(err)
err2 := ErrorWithContext(ctx, err)
if minioError.Code == "XMinioAdminNoSuchGroup" {
Expand Down Expand Up @@ -293,11 +282,6 @@ func getUpdateGroupResponse(session *models.Principal, params groupApi.UpdateGro
}
expectedGroupUpdate := params.Body

groupName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}

mAdmin, err := NewMinioAdminClient(params.HTTPRequest.Context(), session)
if err != nil {
return nil, ErrorWithContext(ctx, err)
Expand All @@ -306,7 +290,7 @@ func getUpdateGroupResponse(session *models.Principal, params groupApi.UpdateGro
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}

groupUpdated, err := groupUpdate(ctx, adminClient, groupName, expectedGroupUpdate)
groupUpdated, err := groupUpdate(ctx, adminClient, params.Name, expectedGroupUpdate)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
Expand Down
9 changes: 0 additions & 9 deletions api/admin_inspect.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ import (
"io"
"net/http"
"strings"
"unicode/utf8"

"github.com/go-openapi/runtime"
"github.com/go-openapi/runtime/middleware"
Expand All @@ -35,14 +34,6 @@ import (

func registerInspectHandler(api *operations.ConsoleAPI) {
api.InspectInspectHandler = inspectApi.InspectHandlerFunc(func(params inspectApi.InspectParams, principal *models.Principal) middleware.Responder {
if v, err := base64.URLEncoding.DecodeString(params.File); err == nil && utf8.Valid(v) {
params.File = string(v)
}

if v, err := base64.URLEncoding.DecodeString(params.Volume); err == nil && utf8.Valid(v) {
params.Volume = string(v)
}

k, r, err := getInspectResult(principal, &params)
if err != nil {
return inspectApi.NewInspectDefault(err.Code).WithPayload(err.APIError)
Expand Down
16 changes: 1 addition & 15 deletions api/admin_objects.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ package api

import (
"context"
"encoding/base64"
"time"

"github.com/minio/mc/cmd"
Expand Down Expand Up @@ -60,20 +59,7 @@ type ObjectResponse struct {
func getObjectsOptionsFromReq(request ObjectsRequest) (*objectsListOpts, error) {
pOptions := objectsListOpts{
BucketName: request.BucketName,
Prefix: "",
}

prefix := request.Prefix

if prefix != "" {
encodedPrefix := SanitizeEncodedPrefix(prefix)
decodedPrefix, err := base64.StdEncoding.DecodeString(encodedPrefix)
if err != nil {
LogError("error decoding prefix: %v", err)
return nil, err
}

pOptions.Prefix = string(decodedPrefix)
Prefix: request.Prefix,
}

if request.Mode == "rewind" {
Expand Down
40 changes: 9 additions & 31 deletions api/admin_policies.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@ import (

bucketApi "github.com/minio/console/api/operations/bucket"
policyApi "github.com/minio/console/api/operations/policy"
"github.com/minio/console/pkg/utils"
s3 "github.com/minio/minio-go/v7"

"github.com/go-openapi/runtime/middleware"
Expand Down Expand Up @@ -308,10 +307,6 @@ func getListPoliciesResponse(session *models.Principal, params policyApi.ListPol
func getListUsersForPolicyResponse(session *models.Principal, params policyApi.ListUsersForPolicyParams) ([]string, *CodedAPIError) {
ctx, cancel := context.WithCancel(params.HTTPRequest.Context())
defer cancel()
policy, err := utils.DecodeBase64(params.Policy)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
mAdmin, err := NewMinioAdminClient(params.HTTPRequest.Context(), session)
if err != nil {
return nil, ErrorWithContext(ctx, err)
Expand All @@ -325,12 +320,12 @@ func getListUsersForPolicyResponse(session *models.Principal, params policyApi.L
}
found := false
for i := range policies {
if policies[i].Name == policy {
if policies[i].Name == params.Policy {
found = true
}
}
if !found {
return nil, ErrorWithContext(ctx, ErrPolicyNotFound, fmt.Errorf("the policy %s does not exist", policy))
return nil, ErrorWithContext(ctx, ErrPolicyNotFound, fmt.Errorf("the policy %s does not exist", params.Policy))
}
users, err := listUsers(ctx, adminClient)
if err != nil {
Expand All @@ -340,7 +335,7 @@ func getListUsersForPolicyResponse(session *models.Principal, params policyApi.L
var filteredUsers []string
for _, user := range users {
for _, upolicy := range user.Policy {
if upolicy == policy {
if upolicy == params.Policy {
filteredUsers = append(filteredUsers, user.AccessKey)
break
}
Expand Down Expand Up @@ -397,12 +392,7 @@ func getSAUserPolicyResponse(session *models.Principal, params policyApi.GetSAUs
}
userAdminClient := AdminClient{Client: mAdminClient}

userName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}

user, err := getUserInfo(ctx, userAdminClient, userName)
user, err := getUserInfo(ctx, userAdminClient, params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
Expand Down Expand Up @@ -467,23 +457,19 @@ func getListGroupsForPolicyResponse(session *models.Principal, params policyApi.
}
// create a minioClient interface implementation
// defining the client to be used
policy, err := utils.DecodeBase64(params.Policy)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
adminClient := AdminClient{Client: mAdmin}
policies, err := listPolicies(ctx, adminClient)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
found := false
for i := range policies {
if policies[i].Name == policy {
if policies[i].Name == params.Policy {
found = true
}
}
if !found {
return nil, ErrorWithContext(ctx, ErrPolicyNotFound, fmt.Errorf("the policy %s does not exist", policy))
return nil, ErrorWithContext(ctx, ErrPolicyNotFound, fmt.Errorf("the policy %s does not exist", params.Policy))
}

groups, err := adminClient.listGroups(ctx)
Expand All @@ -499,7 +485,7 @@ func getListGroupsForPolicyResponse(session *models.Principal, params policyApi.
}
groupPolicies := strings.Split(info.Policy, ",")
for _, groupPolicy := range groupPolicies {
if groupPolicy == policy {
if groupPolicy == params.Policy {
filteredGroups = append(filteredGroups, group)
}
}
Expand All @@ -524,10 +510,6 @@ func getRemovePolicyResponse(session *models.Principal, params policyApi.RemoveP
if params.Name == "" {
return ErrorWithContext(ctx, ErrPolicyNameNotInRequest)
}
policyName, err := utils.DecodeBase64(params.Name)
if err != nil {
return ErrorWithContext(ctx, err)
}
mAdmin, err := NewMinioAdminClient(params.HTTPRequest.Context(), session)
if err != nil {
return ErrorWithContext(ctx, err)
Expand All @@ -536,7 +518,7 @@ func getRemovePolicyResponse(session *models.Principal, params policyApi.RemoveP
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}

if err := removePolicy(ctx, adminClient, policyName); err != nil {
if err := removePolicy(ctx, adminClient, params.Name); err != nil {
return ErrorWithContext(ctx, err)
}
return nil
Expand Down Expand Up @@ -623,11 +605,7 @@ func getPolicyInfoResponse(session *models.Principal, params policyApi.PolicyInf
// create a MinIO Admin Client interface implementation
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}
policyName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
policy, err := policyInfo(ctx, adminClient, policyName)
policy, err := policyInfo(ctx, adminClient, params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
Expand Down
34 changes: 7 additions & 27 deletions api/admin_users.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,6 @@ import (
"sort"
"strings"

"github.com/minio/console/pkg/utils"

"github.com/go-openapi/errors"
"github.com/go-openapi/runtime/middleware"
"github.com/minio/console/api/operations"
Expand Down Expand Up @@ -257,17 +255,13 @@ func getRemoveUserResponse(session *models.Principal, params userApi.RemoveUserP
if err != nil {
return ErrorWithContext(ctx, err)
}
userName, err := utils.DecodeBase64(params.Name)
if err != nil {
return ErrorWithContext(ctx, err)
}
if session.AccountAccessKey == userName {
if session.AccountAccessKey == params.Name {
return ErrorWithContext(ctx, ErrAvoidSelfAccountDelete)
}
// create a minioClient interface implementation
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}
if err := removeUser(ctx, adminClient, userName); err != nil {
if err := removeUser(ctx, adminClient, params.Name); err != nil {
return ErrorWithContext(ctx, err)
}
return nil
Expand Down Expand Up @@ -295,12 +289,7 @@ func getUserInfoResponse(session *models.Principal, params userApi.GetUserInfoPa
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}

userName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}

user, err := getUserInfo(ctx, adminClient, userName)
user, err := getUserInfo(ctx, adminClient, params.Name)
if err != nil {
// User doesn't exist, return 404
if madmin.ToErrorResponse(err).Code == "XMinioAdminNoSuchUser" {
Expand Down Expand Up @@ -335,7 +324,7 @@ func getUserInfoResponse(session *models.Principal, params userApi.GetUserInfoPa
}

userInformation := &models.User{
AccessKey: userName,
AccessKey: params.Name,
MemberOf: user.MemberOf,
Policy: policies,
Status: string(user.Status),
Expand Down Expand Up @@ -446,12 +435,7 @@ func getUpdateUserGroupsResponse(session *models.Principal, params userApi.Updat
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}

userName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}

user, err := updateUserGroups(ctx, adminClient, userName, params.Body.Groups)
user, err := updateUserGroups(ctx, adminClient, params.Name, params.Body.Groups)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
Expand Down Expand Up @@ -486,18 +470,14 @@ func getUpdateUserResponse(session *models.Principal, params userApi.UpdateUserI
// create a minioClient interface implementation
// defining the client to be used
adminClient := AdminClient{Client: mAdmin}
userName, err := utils.DecodeBase64(params.Name)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
status := *params.Body.Status
groups := params.Body.Groups

if err := setUserStatus(ctx, adminClient, userName, status); err != nil {
if err := setUserStatus(ctx, adminClient, params.Name, status); err != nil {
return nil, ErrorWithContext(ctx, err)
}

userElem, errUG := updateUserGroups(ctx, adminClient, userName, groups)
userElem, errUG := updateUserGroups(ctx, adminClient, params.Name, groups)

if errUG != nil {
return nil, ErrorWithContext(ctx, errUG)
Expand Down
17 changes: 6 additions & 11 deletions api/public_objects.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@
package api

import (
b64 "encoding/base64"
"fmt"
"io"
"net/http"
Expand Down Expand Up @@ -45,7 +44,7 @@ func registerPublicObjectsHandlers(api *operations.ConsoleAPI) {
func getDownloadPublicObjectResponse(params public.DownloadSharedObjectParams) (middleware.Responder, *CodedAPIError) {
ctx := params.HTTPRequest.Context()

inputURLDecoded, err := b64toMinIOStringURL(params.URL)
inputURLDecoded, err := checkMinIOStringURL(params.URL)
if err != nil {
return nil, ErrorWithContext(ctx, err)
}
Expand Down Expand Up @@ -91,23 +90,19 @@ func getDownloadPublicObjectResponse(params public.DownloadSharedObjectParams) (
}), nil
}

// b64toMinIOStringURL decodes url and validates is a MinIO url endpoint
func b64toMinIOStringURL(inputEncodedURL string) (*string, error) {
inputURLDecoded, err := b64.URLEncoding.DecodeString(inputEncodedURL)
if err != nil {
return nil, err
}
// checkMinIOStringURL decodes url and validates is a MinIO url endpoint
func checkMinIOStringURL(inputURL string) (*string, error) {
// Validate input URL
inputURL, err := xnet.ParseHTTPURL(string(inputURLDecoded))
parsedURL, err := xnet.ParseHTTPURL(inputURL)
if err != nil {
return nil, err
}
// Ensure incoming url points to MinIO Server
minIOHost := getMinIOEndpoint()
if inputURL.Host != minIOHost {
if parsedURL.Host != minIOHost {
return nil, ErrForbidden
}
return swag.String(string(inputURLDecoded)), nil
return swag.String(inputURL), nil
}

func url2BucketAndObject(u *url.URL) (bucketName, objectName string) {
Expand Down
Loading

0 comments on commit 49c5f5a

Please sign in to comment.