Skip to content

CLDSRV-1021: Compare s3:VersionId with the copy source version ID as sent #6332

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tcarmet wants to merge 3 commits into from
Open

CLDSRV-1021: Compare s3:VersionId with the copy source version ID as sent #6332

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
334be0f
CLDSRV-1021: Add tests for s3:VersionId on the copy source
tcarmet Nov 6, 2026
852d688
CLDSRV-1021: Compare s3:VersionId with the copy source version ID as …
tcarmet Nov 6, 2026
b17b110
CLDSRV-1021: Format the changed files with Prettier
tcarmet Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/api/apiUtils/authorization/permissionChecks.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -486,16 +486,18 @@ function checkBucketPolicy(
// differs from the one the request targets (e.g. the source of a copy)
let bucketName = request?.bucketName;
let objectKey = request?.objectKey;
let query = request?.query;
if (policyTarget) {
bucketName = policyTarget.bucketName;
objectKey = policyTarget.objectKey;
query = Object.assign({}, query, { versionId: policyTarget.versionId });
}
const ip = request ? requestUtils.getClientIp(request, config) : undefined;
const isSecure = request ? requestUtils.getHttpProtocolSecurity(request, config) : undefined;
const requestContext = request
? new RequestContext(
request.headers,
request.query,
query,
bucketName,
objectKey,
ip,
Expand Down
3 changes: 2 additions & 1 deletion lib/api/apiUtils/authorization/prepareRequestContexts.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@ function isHeaderAcl(headers) {
* @param {object} request - request object
* @param {string} sourceBucket - name of sourceBucket if copy request
* @param {string} sourceObject - name of sourceObject if copy request
* @param {string} sourceVersionId - value of sourceVersionId if copy request
* @param {string} sourceVersionId - version ID of the copy source as sent by
* the client, if copy request
* @return {RequestContext []} array of requestContexts
*/
function prepareRequestContexts(apiMethod, request, sourceBucket, sourceObject, sourceVersionId) {
Expand Down
17 changes: 9 additions & 8 deletions lib/api/apiUtils/object/parseCopySource.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,11 @@ const url = require('url');
const querystring = require('querystring');
const { errors } = require('arsenal');

const { decodeVersionId } = require('./versioning');

/** parseCopySource - parse objectCopy or objectPutCopyPart copy source header
* @param {string} apiMethod - api method
* @param {string} copySourceHeader - 'x-amz-copy-source' request header
* @return {object} - sourceBucket, sourceObject, sourceVersionId, parsingError
* @return {object} - sourceBucket, sourceObject, sourceVersionId (as sent by
* the client, the copy APIs decode it), parsingError
*/
function parseCopySource(apiMethod, copySourceHeader) {
if (apiMethod !== 'objectCopy' && apiMethod !== 'objectPutCopyPart') {
Expand All @@ -26,12 +25,14 @@ function parseCopySource(apiMethod, copySourceHeader) {
// Pull the source bucket and source object separated by /
const sourceBucket = source.slice(0, slashSeparator);
const sourceObject = source.slice(slashSeparator + 1);
const sourceVersionId =
decodeVersionId(query ? querystring.parse(query) : undefined);
if (sourceVersionId instanceof Error) {
const err = sourceVersionId;
return { parsingError: err };
const sourceQuery = query ? querystring.parse(query) : undefined;
// A repeated versionId is parsed as an array
if (sourceQuery?.versionId !== undefined && typeof sourceQuery.versionId !== 'string') {
return { parsingError: errors.InvalidArgument };
}
// Authorization compares s3:VersionId with the version ID as the client
// sent it, like for a direct GetObject
const sourceVersionId = sourceQuery?.versionId;

return { sourceBucket, sourceObject, sourceVersionId };
}
Expand Down
29 changes: 19 additions & 10 deletions lib/api/objectCopy.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,8 @@ function _prepMetadata(
* includes normalized headers
* @param {string} sourceBucket - name of source bucket for object copy
* @param {string} sourceObject - name of source object for object copy
* @param {string} sourceVersionId - versionId of source object for copy
* @param {string} sourceVersionId - versionId of source object for copy,
* as sent by the client
* @param {object} log - the log request
* @param {function} callback - final callback to call with the result
* @return {undefined}
Expand All @@ -224,16 +225,24 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
if (keyLengthError) {
return callback(keyLengthError);
}
const decodedVersionId = sourceVersionId ? decodeVID(sourceVersionId) : undefined;
if (decodedVersionId instanceof Error) {
log.trace('invalid copy source versionId', {
versionId: sourceVersionId,
error: decodedVersionId,
});
return callback(decodedVersionId);
}

const sourceIsDestination = destBucketName === sourceBucket && destObjectKey === sourceObject;
const valGetParams = {
authInfo,
bucketName: sourceBucket,
objectKey: sourceObject,
versionId: sourceVersionId,
versionId: decodedVersionId,
getDeleteMarker: true,
// Same action as the one authorized by Vault for the source
requestType: sourceVersionId ? 'objectGetVersion' : 'objectGet',
requestType: decodedVersionId ? 'objectGetVersion' : 'objectGet',
/**
* Authorization will first check the target object, with an objectPut
* action. But in this context, the source object metadata is still
Expand All @@ -244,8 +253,8 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
checkQuota: true,
request,
// The request targets the destination, the bucket policy must be
// evaluated against the source
policyTarget: { bucketName: sourceBucket, objectKey: sourceObject },
// evaluated against the source, with its version ID as sent
policyTarget: { bucketName: sourceBucket, objectKey: sourceObject, versionId: sourceVersionId },
};
const valPutParams = {
authInfo,
Expand Down Expand Up @@ -329,7 +338,7 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
return next(err, null, destBucketMD);
}
if (!sourceObjMD) {
const err = sourceVersionId ? errors.NoSuchVersion : errors.NoSuchKey;
const err = decodedVersionId ? errors.NoSuchVersion : errors.NoSuchKey;
log.debug('no source object', { sourceObject });
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = err);
Expand All @@ -345,7 +354,7 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
if (sourceObjMD.isDeleteMarker) {
log.debug('delete marker on source object', { sourceObject });
let err;
if (sourceVersionId) {
if (decodedVersionId) {
err = errorInstances.InvalidRequest.customizeDescription(
'The source of a copy ' +
'request may not specifically refer to a delete' +
Expand Down Expand Up @@ -399,7 +408,7 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
destObjectKey,
sourceBucketMD,
destBucketMD,
sourceVersionId,
decodedVersionId,
log,
);
if (metadataError) {
Expand Down Expand Up @@ -794,8 +803,8 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
serverSideEncryption.configuredMasterKeyId || serverSideEncryption.masterKeyId,
);
}
if (sourceVersionId) {
additionalHeaders['x-amz-copy-source-version-id'] = versionIdUtils.encode(sourceVersionId);
if (decodedVersionId) {
additionalHeaders['x-amz-copy-source-version-id'] = versionIdUtils.encode(decodedVersionId);
}
const isVersioned = storingNewMdResult && storingNewMdResult.versionId;
if (isVersioned) {
Expand Down
29 changes: 20 additions & 9 deletions lib/api/objectPutCopyPart.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
const { verifyColdObjectAvailable } = require('./apiUtils/object/coldStorage');
const { validateQuotas } = require('./apiUtils/quotas/quotaUtils');
const { setSSEHeaders } = require('./apiUtils/object/sseHeaders');
const { decodeVID } = require('./apiUtils/object/versioning');
const { initializeInternalLogRequestQueue, queueInternalLogRequest } = require('../utilities/serverAccessLogger');

const versionIdUtils = versioning.VersionID;
Expand All @@ -29,636 +30,646 @@
* includes normalized headers
* @param {string} sourceBucket - name of source bucket for object copy
* @param {string} sourceObject - name of source object for object copy
* @param {string} reqVersionId - versionId of the source object for copy
* @param {string} sourceVersionId - versionId of the source object for
* copy, as sent by the client
* @param {object} log - the request logger
* @param {function} callback - final callback to call with the result
* @return {undefined}
*/
function objectPutCopyPart(authInfo, request, sourceBucket, sourceObject, reqVersionId, log, callback) {
function objectPutCopyPart(authInfo, request, sourceBucket, sourceObject, sourceVersionId, log, callback) {
log.debug('processing request', { method: 'objectPutCopyPart' });
const destBucketName = request.bucketName;
const destObjectKey = request.objectKey;
const mpuBucketName = `${constants.mpuBucketPrefix}${destBucketName}`;
const decodedVersionId = sourceVersionId ? decodeVID(sourceVersionId) : undefined;
if (decodedVersionId instanceof Error) {
log.trace('invalid copy source versionId', {
versionId: sourceVersionId,
error: decodedVersionId,
});
monitoring.promMetrics('PUT', destBucketName, 400, 'putObjectCopyPart');
return callback(decodedVersionId);
}
const valGetParams = {
authInfo,
bucketName: sourceBucket,
objectKey: sourceObject,
versionId: reqVersionId,
versionId: decodedVersionId,
getDeleteMarker: true,
// Same action as the one authorized by Vault for the source
requestType: reqVersionId ? 'objectGetVersion' : 'objectGet',
requestType: decodedVersionId ? 'objectGetVersion' : 'objectGet',
/**
* Authorization will first check the target object, with an objectPut
* action. But in this context, the source object metadata is still
* unknown. In the context of quotas, to know the number of bytes that
* are being written, we explicitly enable the quota evaluation logic
* during the objectGet action instead.
*/
checkQuota: true,
request,
// The request targets the destination, the bucket policy must be
// evaluated against the source
policyTarget: { bucketName: sourceBucket, objectKey: sourceObject },
// evaluated against the source, with its version ID as sent
policyTarget: { bucketName: sourceBucket, objectKey: sourceObject, versionId: sourceVersionId },
};

const partNumber = Number.parseInt(request.query.partNumber, 10);
// AWS caps partNumbers at 10,000
if (partNumber > 10000 || !Number.isInteger(partNumber) || partNumber < 1) {
monitoring.promMetrics('PUT', destBucketName, 400, 'putObjectCopyPart');
return callback(errors.InvalidArgument);
}
// We pad the partNumbers so that the parts will be sorted
// in numerical order
const paddedPartNumber = `000000${partNumber}`.substr(-5);
// Note that keys in the query object retain their case, so
// request.query.uploadId must be called with that exact
// capitalization
const {
query: { uploadId },
} = request;

const valPutParams = {
authInfo,
bucketName: destBucketName,
objectKey: destObjectKey,
requestType: 'objectPutPart',
checkQuota: false,
request,
};

// For validating the request at the MPU, the params are the same
// as validating for the destination bucket except additionally need
// the uploadId and splitter.
// Also, requestType is 'putPart or complete'
const valMPUParams = Object.assign(
{
uploadId,
splitter: constants.splitter,
},
valPutParams,
);
valMPUParams.requestType = 'putPart or complete';

const dataStoreContext = {
bucketName: destBucketName,
owner: authInfo.getCanonicalID(),
namespace: request.namespace,
objectKey: destObjectKey,
partNumber: paddedPartNumber,
uploadId,
enableQuota: true,
};

return async.waterfall(
[
function checkDestAuth(next) {
return standardMetadataValidateBucketAndObj(
valPutParams,
request.actionImplicitDenies,
log,
(err, destBucketMD) => {
if (err) {
log.debug('error validating authorization for ' + 'destination bucket', { error: err });
return next(err, destBucketMD);
}
const flag = destBucketMD.hasDeletedFlag() || destBucketMD.hasTransientFlag();
if (flag) {
log.trace('deleted flag or transient flag ' + 'on destination bucket', { flag });
return next(errors.NoSuchBucket);
}
return next(null, destBucketMD);
},
);
},
function checkSourceAuthorization(destBucketMD, next) {
return standardMetadataValidateBucketAndObj(
{
...valGetParams,
serverAccessLogOptions: { copySource: true },
},
request.actionImplicitDenies,
log,
(err, sourceBucketMD, sourceObjMD) => {
if (err) {
log.debug('error validating get part of request', { error: err });
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = err);
return next(err, destBucketMD);
}
if (!sourceObjMD) {
log.debug('no source object', { sourceObject });
const err = reqVersionId ? errors.NoSuchVersion : errors.NoSuchKey;
const err = decodedVersionId ? errors.NoSuchVersion : errors.NoSuchKey;
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = err);
return next(err, destBucketMD);
}
let sourceLocationConstraintName = sourceObjMD.dataStoreName;
// for backwards compatibility before storing dataStoreName
// TODO: handle in objectMD class
if (
!sourceLocationConstraintName &&
sourceObjMD.location[0] &&
sourceObjMD.location[0].dataStoreName
) {
sourceLocationConstraintName = sourceObjMD.location[0].dataStoreName;
}
// check if object data is in a cold storage
const coldErr = verifyColdObjectAvailable(sourceObjMD);
if (coldErr) {
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = coldErr);
return next(coldErr, null);
}
if (sourceObjMD.isDeleteMarker) {
log.debug('delete marker on source object', { sourceObject });
let err;
if (reqVersionId) {
if (decodedVersionId) {
err = errorInstances.InvalidRequest.customizeDescription(
'The source of a copy ' +
'request may not specifically refer to a delete' +
'marker by version id.',
);
} else {
// if user specifies a key in a versioned source bucket
// without specifying a version, and the object has a
// delete marker, return NoSuchKey
err = errors.NoSuchKey;
}
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = err);
return next(err, destBucketMD);
}
const headerValResult = validateHeaders(
request.headers,
sourceObjMD['last-modified'],
sourceObjMD['content-md5'],
);
if (headerValResult.error) {
request.sourceServerAccessLog &&
// eslint-disable-next-line no-param-reassign
(request.sourceServerAccessLog.error = errors.PreconditionFailed);
return next(errors.PreconditionFailed, destBucketMD);
}
const copyLocator = setUpCopyLocator(
sourceObjMD,
request.headers['x-amz-copy-source-range'],
log,
);
if (copyLocator.error) {
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = copyLocator.error);
return next(copyLocator.error, destBucketMD);
}
let sourceVerId;
// If specific version requested, include copy source
// version id in response. Include in request by default
// if versioning is enabled or suspended.
if (sourceBucketMD.getVersioningConfiguration() || reqVersionId) {
if (sourceBucketMD.getVersioningConfiguration() || decodedVersionId) {
if (sourceObjMD.isNull || !sourceObjMD.versionId) {
sourceVerId = 'null';
} else {
sourceVerId = versionIdUtils.encode(sourceObjMD.versionId);
}
}
return next(
null,
copyLocator.dataLocator,
destBucketMD,
copyLocator.copyObjectSize,
sourceVerId,
sourceLocationConstraintName,
sourceObjMD,
);
},
);
},
function _validateQuotas(
dataLocator,
destBucketMD,
copyObjectSize,
sourceVerId,
sourceLocationConstraintName,
sourceObjMD,
next,
) {
return validateQuotas(
request,
destBucketMD,
request.accountQuotas,
valPutParams.requestType,
request.apiMethod,
sourceObjMD?.['content-length'] || 0,
false,
log,
err =>
next(err, dataLocator, destBucketMD, copyObjectSize, sourceVerId, sourceLocationConstraintName),
);
},
// get MPU shadow bucket to get splitter based on MD version
function getMpuShadowBucket(
dataLocator,
destBucketMD,
copyObjectSize,
sourceVerId,
sourceLocationConstraintName,
next,
) {
return metadata.getBucket(mpuBucketName, log, (err, mpuBucket) => {
// TODO: move to `.is` once BKTCLT-9 is done and bumped in Cloudserver
if (err && err.NoSuchBucket) {
return next(errors.NoSuchUpload);
}
if (err) {
log.error('error getting the shadow mpu bucket', {
error: err,
method: 'objectPutCopyPart::metadata.getBucket',
});
return next(err);
}
let splitter = constants.splitter;
if (mpuBucket.getMdBucketModelVersion() < 2) {
splitter = constants.oldSplitter;
}
return next(
null,
dataLocator,
destBucketMD,
copyObjectSize,
sourceVerId,
splitter,
sourceLocationConstraintName,
);
});
},
// Get MPU overview object to check authorization to put a part
// and to get any object location constraint info
function getMpuOverviewObject(
dataLocator,
destBucketMD,
copyObjectSize,
sourceVerId,
splitter,
sourceLocationConstraintName,
next,
) {
const mpuOverviewKey = `overview${splitter}${destObjectKey}${splitter}${uploadId}`;
return metadata.getObjectMD(mpuBucketName, mpuOverviewKey, null, log, (err, res) => {
if (err) {
// TODO: move to `.is` once BKTCLT-9 is done and bumped in Cloudserver
if (err.NoSuchKey) {
return next(errors.NoSuchUpload);
}
log.error('error getting overview object from ' + 'mpu bucket', {
error: err,
method: 'objectPutCopyPart::' + 'metadata.getObjectMD',
});
return next(err);
}
const initiatorID = res.initiator.ID;
const requesterID = authInfo.isRequesterAnIAMUser() ? authInfo.getArn() : authInfo.getCanonicalID();
if (initiatorID !== requesterID) {
return next(errors.AccessDenied);
}
const destObjLocationConstraint = res.controllingLocationConstraint;
const sseAlgo = res['x-amz-server-side-encryption'];
const sse = sseAlgo
? {
algorithm: sseAlgo,
masterKeyId: res['x-amz-server-side-encryption-aws-kms-key-id'],
}
: null;
return next(
null,
dataLocator,
destBucketMD,
destObjLocationConstraint,
copyObjectSize,
sourceVerId,
sourceLocationConstraintName,
sse,
splitter,
);
});
},
function goGetData(
dataLocator,
destBucketMD,
destObjLocationConstraint,
copyObjectSize,
sourceVerId,
sourceLocationConstraintName,
sse,
splitter,
next,
) {
const originalIdentityAuthzResults = request.actionImplicitDenies;
// eslint-disable-next-line no-param-reassign
delete request.actionImplicitDenies;
data.uploadPartCopy(
request,
log,
destBucketMD,
sourceLocationConstraintName,
destObjLocationConstraint,
dataLocator,
dataStoreContext,
locationConstraintCheck,
sse,
(error, eTag, lastModified, serverSideEncryption, locations) => {
// eslint-disable-next-line no-param-reassign
request.actionImplicitDenies = originalIdentityAuthzResults;
if (error) {
if (error.message === 'skip') {
return next(
skipError,
destBucketMD,
eTag,
lastModified,
sourceVerId,
serverSideEncryption,
);
}
// eslint-disable-next-line no-param-reassign
request.sourceServerAccessLog && (request.sourceServerAccessLog.error = error);
return next(error, destBucketMD);
}
return next(
null,
destBucketMD,
locations,
eTag,
copyObjectSize,
sourceVerId,
serverSideEncryption,
lastModified,
splitter,
);
},
);
},
function getExistingPartInfo(
destBucketMD,
locations,
totalHash,
copyObjectSize,
sourceVerId,
serverSideEncryption,
lastModified,
splitter,
next,
) {
const partKey = `${uploadId}${constants.splitter}${paddedPartNumber}`;
metadata.getObjectMD(mpuBucketName, partKey, {}, log, (err, result) => {
// If there is nothing being overwritten just move on
// TODO: move to `.is` once BKTCLT-9 is done and bumped in Cloudserver
if (err && !err.NoSuchKey) {
log.debug('error getting current part (if any)', { error: err });
return next(err);
}
let oldLocations;
let prevObjectSize = null;
if (result) {
oldLocations = result.partLocations;
prevObjectSize = result['content-length'];
// Pull locations to clean up any potential orphans
// in data if object put is an overwrite of
// already existing object with same key and part number
oldLocations = Array.isArray(oldLocations) ? oldLocations : [oldLocations];
}
return next(
null,
destBucketMD,
locations,
totalHash,
prevObjectSize,
copyObjectSize,
sourceVerId,
serverSideEncryption,
lastModified,
oldLocations,
splitter,
);
});
},
function storeNewPartMetadata(
destBucketMD,
locations,
totalHash,
prevObjectSize,
copyObjectSize,
sourceVerId,
serverSideEncryption,
lastModified,
oldLocations,
splitter,
next,
) {
const metaStoreParams = {
partNumber: paddedPartNumber,
contentMD5: totalHash,
size: copyObjectSize,
uploadId,
splitter: constants.splitter,
lastModified,
overheadField: constants.overheadField,
ownerId: destBucketMD.getOwner(),
};
return services.metadataStorePart(mpuBucketName, locations, metaStoreParams, log, err => {
if (err) {
log.debug('error storing new metadata', { error: err, method: 'storeNewPartMetadata' });
return next(err);
}
return next(
null,
locations,
oldLocations,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
splitter,
);
});
},
function checkCanDeleteOldLocations(
partLocations,
oldLocations,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
splitter,
next,
) {
if (!oldLocations) {
return next(
null,
oldLocations,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
);
}
return services.isCompleteMPUInProgress(
{
bucketName: destBucketName,
objectKey: destObjectKey,
uploadId,
splitter,
},
log,
(err, completeInProgress) => {
if (err) {
return next(err, destBucketMD);
}
let oldLocationsToDelete = oldLocations;
// Prevent deletion of old data if a completeMPU
// is already in progress because then there is no
// guarantee that the old location will not be the
// committed one.
if (completeInProgress) {
log.warn('not deleting old locations because CompleteMPU is in progress', {
method: 'objectPutCopyPart::checkCanDeleteOldLocations',
bucketName: destBucketName,
objectKey: destObjectKey,
uploadId,
partLocations,
oldLocations,
});
oldLocationsToDelete = null;
}
return next(
null,
oldLocationsToDelete,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
);
},
);
},
function cleanupExistingData(
oldLocationsToDelete,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
next,
) {
// Clean up the old data now that new metadata (with new
// data locations) has been stored
if (oldLocationsToDelete) {
return data.batchDelete(oldLocationsToDelete, request.method, null, log, err => {
if (err) {
// if error, log the error and move on as it is not
// relevant to the client as the client's
// object already succeeded putting data, metadata
log.error('error deleting existing data', { error: err });
}
return next(
null,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
);
});
}
return next(
null,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
);
},
],
(
err,
destBucketMD,
totalHash,
lastModified,
sourceVerId,
serverSideEncryption,
prevObjectSize,
copyObjectSize,
) => {
const corsHeaders = collectCorsHeaders(request.headers.origin, request.method, destBucketMD);

// Store full object size for server access logs
if (request.serverAccessLog) {
// eslint-disable-next-line no-param-reassign
request.serverAccessLog.objectSize = copyObjectSize;
}

// Initialize the queue for internal log request logging
initializeInternalLogRequestQueue(request);
// Queue the source-side access log (REST.COPY.PART_GET)
queueInternalLogRequest(request, {
operation: 'REST.COPY.PART_GET',
sourceBucket,
sourceObject,
objectSize: copyObjectSize || null,
});

if (err && err !== skipError) {
log.trace('error from copy part waterfall', { error: err });
monitoring.promMetrics('PUT', destBucketName, err.code, 'putObjectCopyPart');
return callback(err, null, corsHeaders);
}
const xml = [
'<?xml version="1.0" encoding="UTF-8"?>',
'<CopyPartResult>',
'<LastModified>',
new Date(lastModified).toISOString(),
'</LastModified>',
'<ETag>&quot;',
totalHash,
'&quot;</ETag>',
'</CopyPartResult>',
].join('');

const additionalHeaders = corsHeaders || {};
if (serverSideEncryption) {
setSSEHeaders(additionalHeaders, serverSideEncryption.algorithm, serverSideEncryption.masterKeyId);
}
additionalHeaders['x-amz-copy-source-version-id'] = sourceVerId;
pushMetric('uploadPartCopy', log, {
authInfo,
canonicalID: destBucketMD.getOwner(),
bucket: destBucketName,
keys: [destObjectKey],
newByteLength: copyObjectSize,
oldByteLength: prevObjectSize,
location: destBucketMD.getLocationConstraint(),
});
monitoring.promMetrics('PUT', destBucketName, '200', 'putObjectCopyPart');
return callback(null, xml, additionalHeaders);
},
);
}

Check notice

Code scanning / CodeQL

Callback-style function (async migration) Note

This function uses a callback parameter ('callback'). Refactor to async/await.

module.exports = objectPutCopyPart;
1 change: 1 addition & 0 deletions lib/metadata/metadataUtils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,6 +357,7 @@ function checkRateLimitIfNeeded(request, authInfo, bucketMD, log, callback) {
* when it differs from the request target, e.g. the source of a copy
* @param {string} params.policyTarget.bucketName - name of bucket
* @param {string} params.policyTarget.objectKey - name of object
* @param {string} [params.policyTarget.versionId] - version ID as sent by the client
* @param {boolean} actionImplicitDenies - identity authorization results
* @param {RequestLogger} log - request logger
* @param {function} callback - callback
Expand Down
Loading
Loading