security: fix critical/high auth, idor, races and persistence
This commit is contained in:
Naeel
@@ -3,117 +3,120 @@
|
||||
package gosqs
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"shared-sqs/app/interfaces"
|
||||
"shared-sqs/app/models"
|
||||
"shared-sqs/app/utils"
|
||||
"github.com/gorilla/mux"
|
||||
log "github.com/sirupsen/logrus"
|
||||
"github.com/gorilla/mux"
|
||||
log "github.com/sirupsen/logrus"
|
||||
"shared-sqs/app/interfaces"
|
||||
"shared-sqs/app/models"
|
||||
"shared-sqs/app/persistence"
|
||||
"shared-sqs/app/utils"
|
||||
)
|
||||
|
||||
func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
|
||||
requestBody := models.NewDeleteMessageBatchRequest()
|
||||
ok := utils.REQUEST_TRANSFORMER(requestBody, req, false)
|
||||
if !ok {
|
||||
log.Error("Invalid Request - DeleteMessageBatchV1")
|
||||
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
|
||||
}
|
||||
requestBody := models.NewDeleteMessageBatchRequest()
|
||||
ok := utils.REQUEST_TRANSFORMER(requestBody, req, false)
|
||||
if !ok {
|
||||
log.Error("Invalid Request - DeleteMessageBatchV1")
|
||||
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
|
||||
}
|
||||
|
||||
t := getTenantFromContext(req)
|
||||
if t == nil {
|
||||
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
|
||||
}
|
||||
t := getTenantFromContext(req)
|
||||
if t == nil {
|
||||
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
|
||||
}
|
||||
|
||||
queueUrl := requestBody.QueueUrl
|
||||
queueName := ""
|
||||
if queueUrl == "" {
|
||||
vars := mux.Vars(req)
|
||||
queueName = vars["queueName"]
|
||||
} else {
|
||||
uriSegments := strings.Split(queueUrl, "/")
|
||||
queueName = uriSegments[len(uriSegments)-1]
|
||||
}
|
||||
queueUrl := requestBody.QueueUrl
|
||||
queueName := ""
|
||||
if queueUrl == "" {
|
||||
vars := mux.Vars(req)
|
||||
queueName = vars["queueName"]
|
||||
} else {
|
||||
uriSegments := strings.Split(queueUrl, "/")
|
||||
queueName = uriSegments[len(uriSegments)-1]
|
||||
}
|
||||
|
||||
key := tenantQueueKey(t.AccessKey, queueName)
|
||||
key := tenantQueueKey(t.AccessKey, queueName)
|
||||
|
||||
if _, ok := models.SyncQueues.Queues[key]; !ok {
|
||||
return utils.CreateErrorResponseV1("QueueNotFound", true)
|
||||
}
|
||||
if _, ok := models.SyncQueues.Queues[key]; !ok {
|
||||
return utils.CreateErrorResponseV1("QueueNotFound", true)
|
||||
}
|
||||
|
||||
if len(requestBody.Entries) == 0 {
|
||||
return utils.CreateErrorResponseV1("EmptyBatchRequest", true)
|
||||
}
|
||||
if len(requestBody.Entries) == 0 {
|
||||
return utils.CreateErrorResponseV1("EmptyBatchRequest", true)
|
||||
}
|
||||
|
||||
if len(requestBody.Entries) > 10 {
|
||||
return utils.CreateErrorResponseV1("TooManyEntriesInBatchRequest", true)
|
||||
}
|
||||
if len(requestBody.Entries) > 10 {
|
||||
return utils.CreateErrorResponseV1("TooManyEntriesInBatchRequest", true)
|
||||
}
|
||||
|
||||
ids := map[string]bool{}
|
||||
for _, v := range requestBody.Entries {
|
||||
if _, found := ids[v.Id]; found {
|
||||
return utils.CreateErrorResponseV1("BatchEntryIdsNotDistinct", true)
|
||||
}
|
||||
ids[v.Id] = true
|
||||
}
|
||||
ids := map[string]bool{}
|
||||
for _, v := range requestBody.Entries {
|
||||
if _, found := ids[v.Id]; found {
|
||||
return utils.CreateErrorResponseV1("BatchEntryIdsNotDistinct", true)
|
||||
}
|
||||
ids[v.Id] = true
|
||||
}
|
||||
|
||||
models.SyncQueues.Lock()
|
||||
defer models.SyncQueues.Unlock()
|
||||
models.SyncQueues.Lock()
|
||||
defer models.SyncQueues.Unlock()
|
||||
|
||||
deleteMessageMap := make(map[string]*deleteEntry)
|
||||
for _, entry := range requestBody.Entries {
|
||||
deleteMessageMap[entry.ReceiptHandle] = &deleteEntry{
|
||||
Id: entry.Id,
|
||||
ReceiptHandle: entry.ReceiptHandle,
|
||||
Deleted: false,
|
||||
}
|
||||
}
|
||||
deleteMessageMap := make(map[string]*deleteEntry)
|
||||
for _, entry := range requestBody.Entries {
|
||||
deleteMessageMap[entry.ReceiptHandle] = &deleteEntry{
|
||||
Id: entry.Id,
|
||||
ReceiptHandle: entry.ReceiptHandle,
|
||||
Deleted: false,
|
||||
}
|
||||
}
|
||||
|
||||
deletedEntries := make([]models.DeleteMessageBatchResultEntry, 0)
|
||||
remainingMessages := make([]models.SqsMessage, 0, len(models.SyncQueues.Queues[key].Messages))
|
||||
deletedEntries := make([]models.DeleteMessageBatchResultEntry, 0)
|
||||
remainingMessages := make([]models.SqsMessage, 0, len(models.SyncQueues.Queues[key].Messages))
|
||||
|
||||
for _, message := range models.SyncQueues.Queues[key].Messages {
|
||||
if de, found := deleteMessageMap[message.ReceiptHandle]; found {
|
||||
log.Debugf("FIFO Queue %s unlocking group %s:", queueName, message.GroupID)
|
||||
models.SyncQueues.Queues[key].UnlockGroup(message.GroupID)
|
||||
delete(models.SyncQueues.Queues[key].Duplicates, message.DeduplicationID)
|
||||
de.Deleted = true
|
||||
deletedEntries = append(deletedEntries, models.DeleteMessageBatchResultEntry{Id: de.Id})
|
||||
} else {
|
||||
remainingMessages = append(remainingMessages, message)
|
||||
}
|
||||
}
|
||||
for _, message := range models.SyncQueues.Queues[key].Messages {
|
||||
if de, found := deleteMessageMap[message.ReceiptHandle]; found {
|
||||
log.Debugf("FIFO Queue %s unlocking group %s:", queueName, message.GroupID)
|
||||
models.SyncQueues.Queues[key].UnlockGroup(message.GroupID)
|
||||
delete(models.SyncQueues.Queues[key].Duplicates, message.DeduplicationID)
|
||||
de.Deleted = true
|
||||
deletedEntries = append(deletedEntries, models.DeleteMessageBatchResultEntry{Id: de.Id})
|
||||
} else {
|
||||
remainingMessages = append(remainingMessages, message)
|
||||
}
|
||||
}
|
||||
|
||||
models.SyncQueues.Queues[key].Messages = remainingMessages
|
||||
models.SyncQueues.Queues[key].Messages = remainingMessages
|
||||
// Персистим обновлённое состояние очереди, чтобы не терять batch-delete после рестарта.
|
||||
persistence.SaveQueue(key, models.SyncQueues.Queues[key])
|
||||
|
||||
notFoundEntries := make([]models.BatchResultErrorEntry, 0)
|
||||
for _, de := range deleteMessageMap {
|
||||
if !de.Deleted {
|
||||
notFoundEntries = append(notFoundEntries, models.BatchResultErrorEntry{
|
||||
Code: "1",
|
||||
Id: de.Id,
|
||||
Message: "Message not found",
|
||||
SenderFault: true,
|
||||
})
|
||||
}
|
||||
}
|
||||
notFoundEntries := make([]models.BatchResultErrorEntry, 0)
|
||||
for _, de := range deleteMessageMap {
|
||||
if !de.Deleted {
|
||||
notFoundEntries = append(notFoundEntries, models.BatchResultErrorEntry{
|
||||
Code: "1",
|
||||
Id: de.Id,
|
||||
Message: "Message not found",
|
||||
SenderFault: true,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
respStruct := models.DeleteMessageBatchResponse{
|
||||
Xmlns: models.BaseXmlns,
|
||||
Result: models.DeleteMessageBatchResult{
|
||||
Successful: deletedEntries,
|
||||
Failed: notFoundEntries,
|
||||
},
|
||||
Metadata: models.BaseResponseMetadata,
|
||||
}
|
||||
respStruct := models.DeleteMessageBatchResponse{
|
||||
Xmlns: models.BaseXmlns,
|
||||
Result: models.DeleteMessageBatchResult{
|
||||
Successful: deletedEntries,
|
||||
Failed: notFoundEntries,
|
||||
},
|
||||
Metadata: models.BaseResponseMetadata,
|
||||
}
|
||||
|
||||
return http.StatusOK, respStruct
|
||||
return http.StatusOK, respStruct
|
||||
}
|
||||
|
||||
type deleteEntry struct {
|
||||
Id string
|
||||
ReceiptHandle string
|
||||
Error string
|
||||
Deleted bool
|
||||
Id string
|
||||
ReceiptHandle string
|
||||
Error string
|
||||
Deleted bool
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user