Skip to content

Commit 85e2fdc

Browse files
EmmaZhuEmmaZhu
authored
Fixed issue of not requiring SAS permission for some specific operations. (#2305)
1 parent 319dc36 commit 85e2fdc

File tree

9 files changed

+375
-143
lines changed

9 files changed

+375
-143
lines changed

‎ChangeLog.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@ General:
88

99
- Add `--inMemoryPersistence` and `--extentMemoryLimit` options and related configs to store all data in-memory without disk persistence. (issue #2227)
1010

11+
Blob:
12+
13+
- Fixed issue of not requiring SAS permission for some specific operations. (issue #2299)
14+
15+
Table:
16+
- Fixed table sas request failure with table name include upper case letter (Issue #1359)
17+
1118
## 2023.10 Version 3.27.0
1219

1320
General:
@@ -35,7 +42,6 @@ Table:
3542
- Fixed the errorCode returned, when malformed Etag is provided for table Update/Delete calls. (issue #2013)
3643
- Fixed an issue when comparing `'' eq guid'00000000-0000-0000-0000-000000000000'` which would erroneously report these as equal. (issue #2169)
3744
- Fixed authentication error in production style URL for secondary location (issue #2208)
38-
- Fixed table sas request failure with table name include upper case letter (Issue #1359)
3945

4046
## 2023.08 Version 3.26.0
4147

‎src/blob/authentication/BlobSASPermissions.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ export enum BlobSASPermission {
44
Create = "c",
55
Write = "w",
66
Delete = "d",
7-
DeleteVersion = "x",
8-
Tag = "t",
9-
Move = "m",
10-
execute = "e",
11-
SetImmutabilityPolicy = "i",
12-
permanentDelete = "y"
7+
DeleteVersion = "x",
8+
Tag = "t",
9+
Move = "m",
10+
execute = "e",
11+
SetImmutabilityPolicy = "i",
12+
permanentDelete = "y"
1313
}

‎src/blob/authentication/ContainerSASPermissions.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@ export enum ContainerSASPermission {
44
Create = "c",
55
Write = "w",
66
Delete = "d",
7-
List = "l"
7+
List = "l",
8+
Any = "AnyPermission" // This is only for blob batch operation.
89
}

‎src/blob/authentication/OperationAccountSASPermission.ts‎

Lines changed: 77 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ import { AccountSASService } from "../../common/authentication/AccountSASService
1212
export class OperationAccountSASPermission {
1313
constructor(
1414
public readonly service: string,
15-
public readonly resourceType?: string,
16-
public readonly permission?: string
17-
) {}
15+
public readonly resourceType: string,
16+
public readonly permission: string
17+
) { }
1818

1919
public validate(
2020
services: AccountSASServices | string,
@@ -35,33 +35,33 @@ export class OperationAccountSASPermission {
3535
public validateResourceTypes(
3636
resourceTypes: AccountSASResourceTypes | string
3737
): boolean {
38-
if (this.resourceType) {
39-
for (const p of this.resourceType) {
40-
if (resourceTypes.toString().includes(p)) {
41-
return true;
42-
}
43-
}
44-
return false;
45-
}
46-
else {
38+
// Only blob batch operation allows Any resource types.
39+
if (this.resourceType === AccountSASResourceType.Any) {
4740
return resourceTypes.toString() !== "";
4841
}
42+
43+
for (const p of this.resourceType) {
44+
if (resourceTypes.toString().includes(p)) {
45+
return true;
46+
}
47+
}
48+
return false;
4949
}
5050

5151
public validatePermissions(
5252
permissions: AccountSASPermissions | string
5353
): boolean {
54-
if (this.permission) {
55-
for (const p of this.permission) {
56-
if (permissions.toString().includes(p)) {
57-
return true;
58-
}
59-
}
60-
return false;
61-
}
62-
else {
54+
// Only blob batch operation allows Any permissions.
55+
if (this.permission === AccountSASPermission.Any) {
6356
return permissions.toString() !== "";
6457
}
58+
59+
for (const p of this.permission) {
60+
if (permissions.toString().includes(p)) {
61+
return true;
62+
}
63+
}
64+
return false;
6565
}
6666
}
6767

@@ -77,16 +77,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
7777
new OperationAccountSASPermission(
7878
AccountSASService.Blob,
7979
AccountSASResourceType.Service +
80-
AccountSASResourceType.Container +
81-
AccountSASResourceType.Object,
80+
AccountSASResourceType.Container +
81+
AccountSASResourceType.Object,
82+
AccountSASPermission.Read +
83+
AccountSASPermission.Create +
84+
AccountSASPermission.Delete +
85+
AccountSASPermission.List +
86+
AccountSASPermission.Process +
8287
AccountSASPermission.Read +
83-
AccountSASPermission.Create +
84-
AccountSASPermission.Delete +
85-
AccountSASPermission.List +
86-
AccountSASPermission.Process +
87-
AccountSASPermission.Read +
88-
AccountSASPermission.Update +
89-
AccountSASPermission.Write
88+
AccountSASPermission.Update +
89+
AccountSASPermission.Write
9090
)
9191
);
9292

@@ -95,16 +95,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
9595
new OperationAccountSASPermission(
9696
AccountSASService.Blob,
9797
AccountSASResourceType.Service +
98-
AccountSASResourceType.Container +
99-
AccountSASResourceType.Object,
98+
AccountSASResourceType.Container +
99+
AccountSASResourceType.Object,
100+
AccountSASPermission.Read +
101+
AccountSASPermission.Create +
102+
AccountSASPermission.Delete +
103+
AccountSASPermission.List +
104+
AccountSASPermission.Process +
100105
AccountSASPermission.Read +
101-
AccountSASPermission.Create +
102-
AccountSASPermission.Delete +
103-
AccountSASPermission.List +
104-
AccountSASPermission.Process +
105-
AccountSASPermission.Read +
106-
AccountSASPermission.Update +
107-
AccountSASPermission.Write
106+
AccountSASPermission.Update +
107+
AccountSASPermission.Write
108108
)
109109
);
110110

@@ -113,16 +113,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
113113
new OperationAccountSASPermission(
114114
AccountSASService.Blob,
115115
AccountSASResourceType.Service +
116-
AccountSASResourceType.Container +
117-
AccountSASResourceType.Object,
116+
AccountSASResourceType.Container +
117+
AccountSASResourceType.Object,
118118
AccountSASPermission.Read +
119-
AccountSASPermission.Create +
120-
AccountSASPermission.Delete +
121-
AccountSASPermission.List +
122-
AccountSASPermission.Process +
123-
AccountSASPermission.Read +
124-
AccountSASPermission.Update +
125-
AccountSASPermission.Write
119+
AccountSASPermission.Create +
120+
AccountSASPermission.Delete +
121+
AccountSASPermission.List +
122+
AccountSASPermission.Process +
123+
AccountSASPermission.Read +
124+
AccountSASPermission.Update +
125+
AccountSASPermission.Write
126126
)
127127
);
128128

@@ -131,16 +131,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
131131
new OperationAccountSASPermission(
132132
AccountSASService.Blob,
133133
AccountSASResourceType.Service +
134-
AccountSASResourceType.Container +
135-
AccountSASResourceType.Object,
134+
AccountSASResourceType.Container +
135+
AccountSASResourceType.Object,
136+
AccountSASPermission.Read +
137+
AccountSASPermission.Create +
138+
AccountSASPermission.Delete +
139+
AccountSASPermission.List +
140+
AccountSASPermission.Process +
136141
AccountSASPermission.Read +
137-
AccountSASPermission.Create +
138-
AccountSASPermission.Delete +
139-
AccountSASPermission.List +
140-
AccountSASPermission.Process +
141-
AccountSASPermission.Read +
142-
AccountSASPermission.Update +
143-
AccountSASPermission.Write
142+
AccountSASPermission.Update +
143+
AccountSASPermission.Write
144144
)
145145
);
146146

@@ -149,16 +149,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
149149
new OperationAccountSASPermission(
150150
AccountSASService.Blob,
151151
AccountSASResourceType.Service +
152-
AccountSASResourceType.Container +
153-
AccountSASResourceType.Object,
152+
AccountSASResourceType.Container +
153+
AccountSASResourceType.Object,
154+
AccountSASPermission.Read +
155+
AccountSASPermission.Create +
156+
AccountSASPermission.Delete +
157+
AccountSASPermission.List +
158+
AccountSASPermission.Process +
154159
AccountSASPermission.Read +
155-
AccountSASPermission.Create +
156-
AccountSASPermission.Delete +
157-
AccountSASPermission.List +
158-
AccountSASPermission.Process +
159-
AccountSASPermission.Read +
160-
AccountSASPermission.Update +
161-
AccountSASPermission.Write
160+
AccountSASPermission.Update +
161+
AccountSASPermission.Write
162162
)
163163
);
164164

@@ -167,16 +167,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
167167
new OperationAccountSASPermission(
168168
AccountSASService.Blob,
169169
AccountSASResourceType.Service +
170-
AccountSASResourceType.Container +
171-
AccountSASResourceType.Object,
170+
AccountSASResourceType.Container +
171+
AccountSASResourceType.Object,
172172
AccountSASPermission.Read +
173-
AccountSASPermission.Create +
174-
AccountSASPermission.Delete +
175-
AccountSASPermission.List +
176-
AccountSASPermission.Process +
177-
AccountSASPermission.Read +
178-
AccountSASPermission.Update +
179-
AccountSASPermission.Write
173+
AccountSASPermission.Create +
174+
AccountSASPermission.Delete +
175+
AccountSASPermission.List +
176+
AccountSASPermission.Process +
177+
AccountSASPermission.Read +
178+
AccountSASPermission.Update +
179+
AccountSASPermission.Write
180180
)
181181
);
182182

@@ -211,8 +211,8 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
211211
Operation.Service_SubmitBatch,
212212
new OperationAccountSASPermission(
213213
AccountSASService.Blob,
214-
"",
215-
"" // NOT ALLOWED
214+
AccountSASResourceType.Any,
215+
AccountSASPermission.Any
216216
)
217217
);
218218

‎src/blob/authentication/OperationBlobSASPermission.ts‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,24 @@ import { BlobSASPermission } from "./BlobSASPermissions";
33
import { ContainerSASPermission } from "./ContainerSASPermissions";
44

55
export class OperationBlobSASPermission {
6-
constructor(public readonly permission: string = "") {}
6+
constructor(public readonly permission: string = "") { }
77

88
public validate(permissions: string): boolean {
99
return this.validatePermissions(permissions);
1010
}
1111

1212
public validatePermissions(permissions: string): boolean {
13-
if (this.permission !== "") {
14-
for (const p of this.permission) {
15-
if (permissions.toString().includes(p)) {
16-
return true;
17-
}
18-
}
19-
return false;
20-
}
21-
else {
13+
// Only blob batch operation allows Any permissions.
14+
if (this.permission === ContainerSASPermission.Any) {
2215
return permissions.toString() !== "";
2316
}
17+
18+
for (const p of this.permission) {
19+
if (permissions.toString().includes(p)) {
20+
return true;
21+
}
22+
}
23+
return false;
2424
}
2525
}
2626

@@ -335,7 +335,7 @@ OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
335335
);
336336
OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
337337
Operation.Container_SubmitBatch,
338-
new OperationBlobSASPermission()
338+
new OperationBlobSASPermission(ContainerSASPermission.Any)
339339
);
340340
OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
341341
Operation.Container_GetAccessPolicy,

‎src/common/authentication/AccountSASPermissions.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,9 @@ export enum AccountSASPermission {
1010
Process = "p",
1111
Tag = "t",
1212
Filter = "f",
13-
SetImmutabilityPolicy = "i",
14-
PermanentDelete = "y"
13+
SetImmutabilityPolicy = "i",
14+
PermanentDelete = "y",
15+
Any = "AnyPermission" // This is only used for blob batch operation.
1516
}
1617

1718
/**

‎src/common/authentication/AccountSASResourceTypes.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
export enum AccountSASResourceType {
22
Service = "s",
33
Container = "c",
4-
Object = "o"
4+
Object = "o",
5+
Any = "AnyResourceType" // This is only used for blob batch operation.
56
}
67

78
/**

0 commit comments

Comments
 (0)