CVE-2022-3854: rgw: Guard against malformed bucket URLs

Fixes: https://tracker.ceph.com/issues/55765
Fixes: https://tracker.ceph.com/issues/56586
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Origin: upstream, https://github.com/ceph/ceph/pull/47194/commits/9746e8011ff1de6de7dba9c0041e28a16c8f6828.patch
Bug-Debian: https://bugs.debian.org/1027151
Last-Update: 2022-01-09

Misplaced colons can result in radosgw thinking is has a bucket URL
but with no bucket name, leading to a crash later on.

Gbp-Pq: Name CVE-2022-3854_1_rgw_Guard_against_malformed_bucket_URLs.patch

diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc
index bc55ed8b41109c41d6a5395376eef8b5167582a2..a413f88fd7b4a9443dbb2ab6cd2fb9b2525d600b 100644 (file)
--- a/src/rgw/rgw_common.cc
+++ b/src/rgw/rgw_common.cc
@@ -1276,6 +1276,11 @@ bool verify_bucket_permission_no_policy(const DoutPrefixProvider* dpp, struct re
 
 bool verify_bucket_permission_no_policy(const DoutPrefixProvider* dpp, struct req_state * const s, const int perm)
 {
+  if (rgw::sal::RGWBucket::empty(s->bucket)) {
+    // request is missing a bucket name
+    return false;
+  }
+
   perm_state_from_req_state ps(s);
 
   if (!verify_requester_payer_permission(&ps))