https://silo.pgsty.com/zh/tags/authorization/ Recent content in Authorization on SILO Hugo zh-CN Sat, 24 Oct 2026 18:19:49 +0800 https://silo.pgsty.com/zh/blog/security/object-grant-bucket-reach/ Tue, 04 Aug 2026 00:00:00 +0000 https://silo.pgsty.com/zh/blog/security/object-grant-bucket-reach/ <p><strong><code>SN-2026-004</code></strong> 修复了 <a href="https://github.com/pgsty/silo-pkg/releases/tag/v3.11.0">silo-pkg <code>v3.11.0</code></a>（提交 <code>3c24ad1</code>、<code>1f97549</code>、<code>d8b1fa7</code>）与 <a href="https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z">Server 20260804</a>（<code>97b7d2804</code>；上游参考 <a href="https://github.com/minio/minio/issues/20449"><code>minio/minio#20449</code></a>）中的一处 IAM 资源匹配缺陷：在评估桶级 S3 请求（<code>args.ObjectName == &quot;&quot;</code>）时，<code>Statement.IsAllowed</code> 会固定在桶名末尾拼接 <code>'/'</code> 生成 <code>&quot;bucket/&quot;</code> 作为待匹配资源字符串，导致原本仅面向桶内对象的通配授权（如 <code>Allow s3:* on arn:aws:s3:::bucket/*</code>）能够越界放行 <code>s3:PutBucketPolicy</code>、<code>s3:DeleteBucket</code> 等高危桶级变更操作。</p>