Problem/Motivation

When preventCrossSchemeAccess() was moved to a trait the reference to $this->config[] was kept, this works for S3fsStreamWrapper but does not work for S3fsFileService. This allows for a False Positive inside S3fsFileService if the public/private paths have been renamed. This additionally allows a False Negative if the path has been renamed however due to the need to prepare the destination directory which uses S3fsStreamWrapper the operation would general fail prior to uploading the file.

Inside of preventCrossSchemeAccess() a false positive could occur for s3://configured-prefix-something preventing creating paths that contained the public/private prefix.

Addtionaly there was a possible false negative on nested public under private (and vice versa) for creating the 'root' level directory however any file operations below that would trigger the exception.

Steps to reproduce

Proposed resolution

Commit patch with enhanced testing of the trait.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

cmlara created an issue. See original summary.

  • cmlara committed 80e9294 on 8.x-3.x
    Issue #3320606: False Postive/Negative from preventCrossSchemeAccess()
    
cmlara’s picture

Title: False Postive/Negative from preventCrossSchemeAccess() » False Positive/Negative from preventCrossSchemeAccess()
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.