Copilot commented on code in PR #10875:
URL: https://github.com/apache/ozone/pull/10875#discussion_r3654953915
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java:
##########
@@ -303,6 +341,87 @@ private Response handleAssumeRole(String roleArn, String
roleSessionName, Intege
}
}
+ private AssumeRoleParamValidationResult
validateAssumeRoleParameters(Set<String> paramNamesToValidate) {
+ if (paramNamesToValidate == null || paramNamesToValidate.isEmpty()) {
+ return AssumeRoleParamValidationResult.empty();
+ }
+
+ final List<String> notImplementedOptionalParams = new ArrayList<>();
+ final List<String> unsupportedParams = new ArrayList<>();
+ for (String paramName : paramNamesToValidate) {
+ if (isAllowedAssumeRoleParameter(paramName)) {
+ continue;
+ }
+
+ if (isAwsValidButNotImplementedAssumeRoleParameter(paramName)) {
+ notImplementedOptionalParams.add(paramName);
+ } else {
+ unsupportedParams.add(paramName);
+ }
+ }
+
+ Collections.sort(notImplementedOptionalParams);
+ Collections.sort(unsupportedParams);
+ return new AssumeRoleParamValidationResult(notImplementedOptionalParams,
unsupportedParams);
+ }
+
+ private static boolean isAllowedAssumeRoleParameter(String paramName) {
+ return StringUtils.isBlank(paramName)
+ || ASSUME_ROLE_ALLOWED_PARAMS.contains(paramName)
+ || Strings.CI.startsWith(paramName, SIGV4_PARAM_PREFIX);
+ }
Review Comment:
`isAllowedAssumeRoleParameter` currently treats blank parameter names as
allowed (`StringUtils.isBlank(paramName)`), which means malformed requests like
`?=x` (empty key) bypass the new unsupported-parameter validation and are
silently ignored. Since this change is intended to reject unsupported/invalid
AssumeRole parameters, blank names should be treated as unsupported instead of
allowed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
