aliyun / aliyun-oss-python-sdk

Aliyun OSS SDK for Python
MIT License
939 stars 363 forks source link

To operate an empty key will result in operating the bucket #342

Open yonoho opened 1 year ago

yonoho commented 1 year ago

in file oss2/api.py: Line 2753

    def __do_object(self, method, key, **kwargs):
        return self._do(method, self.bucket_name, key, **kwargs)

    def __do_bucket(self, method, **kwargs):
        return self._do(method, self.bucket_name, '', **kwargs)

As it shows, when calling __do_object() with key='', it equals calling __do_bucket(), and there aren't any checks before that。if the client calls bucket.delete_object(key='') accidentally, the whole bucket may be deleted, which is really dangerous.