jubos / fake-s3

A lightweight server clone of Amazon S3 that simulates most of the commands supported by S3 with minimal dependencies
2.94k stars 355 forks source link

[Bug] Prevent directory traversal #251

Open ab-pm opened 4 years ago

ab-pm commented 4 years ago

According to https://docs.aws.amazon.com/AmazonS3/latest/user-guide/using-folders.html

buckets and objects are the primary resources, and objects are stored in buckets. Amazon S3 has a flat structure instead of a hierarchy like you would see in a file system. However, for the sake of organizational simplicity, the Amazon S3 console supports the folder concept as a means of grouping objects. Amazon S3 does this by using a shared name prefix for objects

A "folder" is nothing but a convention for objects with a trailing / in their name in the S3 console or web UI.

It's fine if fake-s3 stores objects in the file system hierarchy as an implementation detail, but this should not leak into the observable behavior. One problem that this creates is #151, another is that path normalisation means when I PUT a/b/c.x into my bucket, I can not only access (GET) it by a/b/c.x but also a/b/../b/c.x. These should be separate objects though.