From 3aaf80b33b71d65da50b28c9ce592e649c366c5e Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Sun, 11 Oct 2026 20:10:35 -0700 Subject: [PATCH] s3: stop trusting internal ACL headers in ParseS3Metadata Multipart initiation stored client-supplied Seaweed-X-Amz-Acl and Seaweed-X-Amz-Owner request headers onto the upload entry, and CompleteMultipartUpload copied them to the finished object, letting a caller forge ownership or a public ACL without s3:PutObjectAcl. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- weed/s3api/s3_metadata_util.go | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/weed/s3api/s3_metadata_util.go b/weed/s3api/s3_metadata_util.go index 6f71776f1..bcd62b0e9 100644 --- a/weed/s3api/s3_metadata_util.go +++ b/weed/s3api/s3_metadata_util.go @@ -94,18 +94,6 @@ func ParseS3Metadata(r *http.Request, existing map[string][]byte, isReplace bool metadata[s3_constants.AmzServerSideEncryptionCustomerKeyMD5] = []byte(keyMD5) } - // ACL owner - acpOwner := r.Header.Get(s3_constants.ExtAmzOwnerKey) - if len(acpOwner) > 0 { - metadata[s3_constants.ExtAmzOwnerKey] = []byte(acpOwner) - } - - // ACL grants - acpGrants := r.Header.Get(s3_constants.ExtAmzAclKey) - if len(acpGrants) > 0 { - metadata[s3_constants.ExtAmzAclKey] = []byte(acpGrants) - } - return metadata, s3err.ErrNone }