Bug #44635: Params "append" and "position" are not signed when append object - rgw - Ceph

Actions

Copy link

Bug #44635

open

Params "append" and "position" are not signed when append object

Added by yunqing wang about 4 years ago. Updated about 4 years ago.

Status:

In Progress

Priority:

Normal

Assignee:

Casey Bodley

Target version:

Ceph - v14.2.5

% Done:

100%

Source:

Community (dev)

Tags:

append object

Backport:

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

rgw

Pull request ID:

34002

Crash signature (v1):

Crash signature (v2):

Description

When I append an oject, I found out that the param "append" and "position" are not signed in rgw. If the request was hacked and the param "position" was changed, it will make the request fail always.
We need calculate key signature inclued the two params.