From 2efa9c5a1a568e28e41af790750f224d334d4e3d Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Tue, 27 Feb 2024 22:59:30 +0100
Subject: [fix-presigned] PostObject: verify X-Amz-Algorithm

---
 src/api/signature/payload.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'src')

diff --git a/src/api/signature/payload.rs b/src/api/signature/payload.rs
index 29ed7081..8841a5e5 100644
--- a/src/api/signature/payload.rs
+++ b/src/api/signature/payload.rs
@@ -449,6 +449,16 @@ impl Authorization {
 	}
 
 	pub(crate) fn parse_form(params: &HeaderMap) -> Result<Self, Error> {
+		let algorithm = params
+			.get(X_AMZ_ALGORITHM)
+			.ok_or_bad_request("Missing X-Amz-Algorithm header")?
+			.to_str()?;
+		if algorithm != AWS4_HMAC_SHA256 {
+			return Err(Error::bad_request(
+				"Unsupported authorization method".to_string(),
+			));
+		}
+
 		let credential = params
 			.get(X_AMZ_CREDENTIAL)
 			.ok_or_else(|| Error::forbidden("Garage does not support anonymous access yet"))?
-- 
cgit v1.2.3