[
https://issues.apache.org/jira/browse/HDDS-16393?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Prince Raj updated HDDS-16393:
------------------------------
Summary: PutBucketLifecycle accepts oversized Days value and silently
truncates on store (was: Object-ttl: PutBucketLifecycle accepts oversized Days
value and silently truncates on store)
> PutBucketLifecycle accepts oversized Days value and silently truncates on
> store
> -------------------------------------------------------------------------------
>
> Key: HDDS-16393
> URL: https://issues.apache.org/jira/browse/HDDS-16393
> Project: Apache Ozone
> Issue Type: Bug
> Reporter: Prince Raj
> Assignee: Priyesh Karatha
> Priority: Major
>
> {{PutBucketLifecycleConfiguration}} accepts an extremely large {{Days}} value
> without validation and returns {*}HTTP 200{*}. When the lifecycle
> configuration is subsequently retrieved using
> {{{}GetBucketLifecycleConfiguration{}}}, the stored value differs from the
> value provided in the request.
> This results in the user-provided lifecycle configuration being {*}silently
> modified{*}.
> h2. Steps to Reproduce
> # Send a lifecycle configuration containing an extremely large {{Days}}
> value:
>
> {{{
> "Rules": [
> \{
> "ID": "expire-rule",
> "Status": "Enabled",
> "Expiration": {
> "Days": 3323232323232323232323232323232323232323232
> }
> }
> ]}}}
> # Execute {{{}PutBucketLifecycleConfiguration{}}}.
> # Observe that the request succeeds with {*}HTTP 200{*}.
> # Execute {{{}GetBucketLifecycleConfiguration{}}}.
> # Observe that the returned {{Days}} value is different from the value
> provided in the original request.
> For example, the request specifies:
>
> {{3323232323232323232323232323232323232323232}}
> but the returned configuration contains:
>
> {{347068064}}
> h2. Expected Behavior
> {{PutBucketLifecycleConfiguration}} should validate the {{Days}} value before
> persisting the lifecycle configuration.
> If the value exceeds the supported range, the request should fail with *HTTP
> 400 (Bad Request)* and return a clear validation error indicating that the
> {{Days}} value is invalid or out of range.
> The service should not silently truncate, overflow, or otherwise modify the
> value provided by the user.
> h2. Actual Behavior
> * {{PutBucketLifecycleConfiguration}} accepts an extremely large {{Days}}
> value.
> * The request returns {*}HTTP 200{*}.
> * The value is modified when the configuration is persisted.
> * {{GetBucketLifecycleConfiguration}} returns a different {{Days}} value
> from the one provided in the original request.
> h2. Impact
> A lifecycle configuration can be stored with a value different from what the
> user requested, while the PUT operation reports success. This can result in
> unexpected object expiration behavior.
> h2. Suggested Fix
> * Validate the {{Days}} field before persisting the lifecycle configuration.
> * Define and enforce the supported range for {{{}Days{}}}.
> * Reject values outside the supported range with {*}HTTP 400{*}.
> * Return a clear validation error.
> * Do not silently truncate, overflow, or modify user-provided values.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
