[s3] validate indirect filer path inputs (#9931)

* s3: validate indirect filer path inputs

* s3: avoid query parsing on common request path

* filer: scope copy/move source against JWT AllowedPrefixes

maybeCheckJwtAuthorization only checked r.URL.Path, but copy and move read
their source from the cp.from / mv.from query params. A prefix-restricted
token could copy or move data out of a subtree it cannot otherwise reach.
Check every path the request touches, reusing pathHasComponentPrefix so
`..` in the source is collapsed before the prefix match.

* s3: confine iceberg CreateTable location to the catalog bucket

CreateTable derived the metadata bucket and path from the client-supplied
req.Location / req.Name and wrote there directly, so a caller scoped to one
table bucket could place metadata in another bucket (and path.Join collapsed
any `..`). Require the parsed bucket to equal the request's catalog bucket
and reject traversal segments in the table path.

* webdav: clean client path before subFolder confinement

wrappedFs concatenated subFolder + name before the underlying FileSystem
ran path.Clean, so `..` in the request path or COPY/MOVE Destination
resolved across the FilerRootPath confinement boundary. Clean the name as a
rooted path first so traversal segments collapse below subFolder. Only the
non-default -filer.path (non-empty subFolder) setup was affected.

* filer: enforce read-only rule on real write path with destination header

The x-seaweedfs-destination header overrides the path used for storage-rule
matching while the entry is written at r.URL.Path, letting a caller select a
writable rule for a read-only target. When the header is present, also check
the read-only/quota rule against the actual write path.

weed/s3api/s3api_path_validation.go

@@ -2,12 +2,52 @@ package s3api
 
 import (
 	"net/http"
+	"net/url"
+	"strings"
 
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
 
+func hasPathSegmentQuery(rawQuery string) bool {
+	if strings.Contains(rawQuery, "versionId") || strings.Contains(rawQuery, "uploadId") {
+		return true
+	}
+	if !strings.Contains(rawQuery, "%") {
+		return false
+	}
+
+	for rawQuery != "" {
+		field := rawQuery
+		if i := strings.IndexByte(rawQuery, '&'); i >= 0 {
+			field, rawQuery = rawQuery[:i], rawQuery[i+1:]
+		} else {
+			rawQuery = ""
+		}
+		if i := strings.IndexByte(field, '='); i >= 0 {
+			field = field[:i]
+		}
+		if !strings.Contains(field, "%") {
+			continue
+		}
+		key, err := url.QueryUnescape(field)
+		if err == nil && (key == "versionId" || key == "uploadId") {
+			return true
+		}
+	}
+	return false
+}
+
+func hasInvalidPathSegment(values []string) bool {
+	for _, value := range values {
+		if value != "" && !s3_constants.IsValidPathSegment(value) {
+			return true
+		}
+	}
+	return false
+}
+
 // validateRequestPath rejects requests whose captured {bucket}/{object} mux
 // vars would normalize to a parent-directory traversal once joined into a
 // filer path. The router runs with mux.NewRouter().SkipClean(true), so
@@ -33,6 +73,15 @@ func validateRequestPath(next http.Handler) http.Handler {
 				return
 			}
 		}
+		// versionId and uploadId are later used as filer entry names. Avoid
+		// parsing every request's query while still recognizing encoded names.
+		if hasPathSegmentQuery(r.URL.RawQuery) {
+			query := r.URL.Query()
+			if hasInvalidPathSegment(query["versionId"]) || hasInvalidPathSegment(query["uploadId"]) {
+				s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+				return
+			}
+		}
 		next.ServeHTTP(w, r)
 	})
 }