Skip to content
This repository has been archived by the owner on Feb 12, 2024. It is now read-only.

[Bug] Prevent directory traversal #251

Open
ab-pm opened this issue Jul 29, 2020 · 0 comments
Open

[Bug] Prevent directory traversal #251

ab-pm opened this issue Jul 29, 2020 · 0 comments

Comments

@ab-pm
Copy link

ab-pm commented Jul 29, 2020

According to https://docs.aws.amazon.com/AmazonS3/latest/user-guide/using-folders.html

buckets and objects are the primary resources, and objects are stored in buckets. Amazon S3 has a flat structure instead of a hierarchy like you would see in a file system. However, for the sake of organizational simplicity, the Amazon S3 console supports the folder concept as a means of grouping objects. Amazon S3 does this by using a shared name prefix for objects

A "folder" is nothing but a convention for objects with a trailing / in their name in the S3 console or web UI.

It's fine if fake-s3 stores objects in the file system hierarchy as an implementation detail, but this should not leak into the observable behavior. One problem that this creates is #151, another is that path normalisation means when I PUT a/b/c.x into my bucket, I can not only access (GET) it by a/b/c.x but also a/b/../b/c.x. These should be separate objects though.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant