adoroszlai commented on code in PR #10749:
URL: https://github.com/apache/ozone/pull/10749#discussion_r3577623989
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/signature/MalformedResourceException.java:
##########
@@ -23,17 +23,32 @@
*/
public class MalformedResourceException extends Exception {
private final String resource;
+ private final boolean accessDenied;
public MalformedResourceException(String resource) {
+ this(resource, false);
+ }
+
+ public MalformedResourceException(String resource, boolean accessDenied) {
this.resource = resource;
+ this.accessDenied = accessDenied;
Review Comment:
I think we should use a dedicated exception for "access denied" case, e.g.
`org.apache.hadoop.security.AccessControlException`, or create a new class if
needed.
##########
hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3/signature/TestAWSSignatureProcessor.java:
##########
@@ -37,4 +46,35 @@ public void
testLowerCaseHeaderMapRemovesKeysCaseInsensitively() {
headers.remove("AUTHORIZATION"));
assertFalse(headers.containsKey("authorization"));
}
+
+ @Test
+ public void testOutOfRangeExpiresPreSignedUrlReturns403() throws Exception {
+ // A pre-signed URL whose X-Amz-Expires is out of range must be rejected
+ // with 403 AccessDenied, not 400 MalformedHeader.
+ MultivaluedMap<String, String> queryParams = new MultivaluedHashMap<>();
+ queryParams.putSingle("X-Amz-Algorithm", "AWS4-HMAC-SHA256");
+ queryParams.putSingle("X-Amz-Credential",
+ "AKIAIOSFODNN7EXAMPLE%2F20130524%2Fus-east-1%2Fs3%2Faws4_request");
+ queryParams.putSingle("X-Amz-Date", "20130524T000000Z");
+ queryParams.putSingle("X-Amz-Expires", "604801");
+ queryParams.putSingle("X-Amz-SignedHeaders", "host");
+ queryParams.putSingle("X-Amz-Signature",
+ "aeeed9bbccd4d02ee5c0109b86d86835f995330da4c265957d157751f604d404");
+
+ UriInfo uriInfo = mock(UriInfo.class);
+ when(uriInfo.getQueryParameters()).thenReturn(queryParams);
+ when(uriInfo.getPathParameters()).thenReturn(new MultivaluedHashMap<>());
+ when(uriInfo.getPath()).thenReturn("key");
+ ContainerRequestContext context = mock(ContainerRequestContext.class);
+ when(context.getUriInfo()).thenReturn(uriInfo);
+ when(context.getHeaders()).thenReturn(new MultivaluedHashMap<>());
+ when(context.getMethod()).thenReturn("GET");
+
+ AWSSignatureProcessor processor = new AWSSignatureProcessor();
+ processor.setContext(context);
+
+ OS3Exception ex = assertThrows(OS3Exception.class,
processor::parseSignature);
+ assertEquals(HttpStatus.SC_FORBIDDEN, ex.getHttpCode());
+ assertEquals("AccessDenied", ex.getCode());
Review Comment:
nit: simplfy using `EndpointTestUtils.assertErrorResponse`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
