mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-30 17:00:48 +01:00
Chris LuandDevin
5fdb061c99
ResolveS3Action derives the authorized action from the request's method+query, overriding the caller's base action. A governance-bypass check on DELETE ?versionId=... therefore evaluated s3:DeleteObjectVersion instead of s3:BypassGovernanceRetention, letting an identity that holds version-delete but not bypass delete a GOVERNANCE-locked version (GHSA-j4hf-8r83-7fjj). The same substitution let s3:GetObjectVersion satisfy GetObjectRetention/GetObjectLegalHold on ?versionId requests, and silently dropped bucket-policy grants of the bypass action on versioned deletes. Object Lock actions name a concrete permission checked on top of another operation's shape; resolve them to themselves, like iam:/sts: actions. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>