fix: validate and apply the ListBuckets bucket-region query

ListBuckets ignored bucket-region: a value that is not a region was
accepted, and a region other than the gateway one still listed every
bucket. S3 rejects an invalid value with 400 InvalidArgument, "Argument
value abc is not a valid AWS Region", and lists only the buckets of the
requested region.

Check bucket-region against the AWS region code format, always
accepting the gateway region whatever its name, and return an empty
list for any other region, since every bucket lives in the gateway
region. Enable the REST tests that cover both cases.

Fixes #1923
Fixes #1930
This commit is contained in:
dualfroz committed 2026-10-05 20:42:18 +02:00
1 parent 2bb327ec69
commit b7ff97181d
8 files changed
+175 -6

No files matched your search

+17
View File
@@ -17,7 +17,9 @@ package controllers
import (
"github.com/gofiber/fiber/v3"
"github.com/versity/versitygw/auth"
"github.com/versity/versitygw/debuglogger"
"github.com/versity/versitygw/s3api/utils"
"github.com/versity/versitygw/s3err"
"github.com/versity/versitygw/s3response"
)
@@ -25,6 +27,7 @@ func (c S3ApiController) ListBuckets(ctx fiber.Ctx) (*Response, error) {
cToken := ctx.Query("continuation-token")
prefix := ctx.Query("prefix")
maxBucketsStr := ctx.Query("max-buckets")
bucketRegion := ctx.Query("bucket-region")
acct := utils.ContextKeyAccount.Get(ctx).(auth.Account)
isRoot, _ := utils.ContextKeyIsRoot.Get(ctx).(bool)
@@ -55,6 +58,13 @@ func (c S3ApiController) ListBuckets(ctx fiber.Ctx) (*Response, error) {
}, err
}
if bucketRegion != "" && !utils.IsValidBucketRegion(bucketRegion, region) {
debuglogger.Logf("invalid bucket region: %s", bucketRegion)
return &Response{
MetaOpts: &MetaOptions{},
}, s3err.GetInvalidArgBucketRegion(bucketRegion)
}
// IsAdmin is the backends' "return every bucket, unfiltered" flag.
res, err := c.be.ListBuckets(ctx.RequestCtx(),
s3response.ListBucketsInput{
@@ -68,6 +78,13 @@ func (c S3ApiController) ListBuckets(ctx fiber.Ctx) (*Response, error) {
return &Response{}, err
}
// every bucket lives in the gateway region, so there is nothing
// to list for any other region
if bucketRegion != "" && bucketRegion != region {
res.Buckets.Bucket = nil
res.ContinuationToken = ""
}
for i := range res.Buckets.Bucket {
res.Buckets.Bucket[i].BucketRegion = region
}