security: fix critical/high auth, idor, races and persistence

app/router/router.go

@@ -147,7 +147,11 @@ func extractAction(req *http.Request) string {
 	switch protocol {
 	case AwsJsonProtocol:
 		action := req.Header.Get("X-Amz-Target")
-		return strings.Split(action, ".")[1]
+		parts := strings.SplitN(action, ".", 2)
+		if len(parts) != 2 || parts[1] == "" {
+			return ""
+		}
+		return parts[1]
 	case AwsQueryProtocol:
 		return req.FormValue("Action")
 	}