Harden security: fail-closed policies, presigned URL time/expiry validation, SSRF DNS pinning, lockout cap, proxy trust config

2026-02-22 17:55:40 +08:00
parent 6ab702a818
commit fb32ca0a7d
7 changed files with 72 additions and 28 deletions
--- a/app/bucket_policies.py
+++ b/app/bucket_policies.py
@@ -75,7 +75,7 @@ def _evaluate_condition_operator(
        expected_null = condition_values[0].lower() in ("true", "1", "yes") if condition_values else True
        return is_null == expected_null

-    return True
+    return False

 ACTION_ALIASES = {
    "s3:listbucket": "list",