Skip to content

Commit 67eb371

Browse files
author
garenwang
committed
1、修复安全漏洞
2、修复分块上传续传时只能拉取1000个分块
1 parent 58993d8 commit 67eb371

30 files changed

+361
-48
lines changed

‎CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# 6.4.5
2+
1、安全漏洞修复
3+
14
# 6.4.4
25
1、增加上传接口取消时类型保护
36

‎QCloudCOSXML.podspec

+4-4
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Pod::Spec.new do |s|
22
s.name = "QCloudCOSXML"
33

44

5-
s.version = "6.4.4"
5+
s.version = "6.4.5"
66

77

88
s.summary = "QCloudCOSXML 腾讯云iOS-SDK组件"
@@ -20,15 +20,15 @@ s.version = "6.4.4"
2020
s.default_subspec = 'Default'
2121
s.subspec 'Default' do |default|
2222
default.source_files = 'QCloudCOSXML/Classes/**/*','QCloudCOSXML/Classes/QCloudCOSXML/*'
23-
default.dependency "QCloudCore",'6.4.4'
23+
default.dependency "QCloudCore",'6.4.5'
2424
end
2525
s.subspec 'Slim' do |slim|
2626
slim.source_files = 'QCloudCOSXML/Classes/**/*','QCloudCOSXML/Classes/QCloudCOSXML/*'
27-
slim.dependency "QCloudCore/WithoutMTA",'6.4.4'
27+
slim.dependency "QCloudCore/WithoutMTA",'6.4.5'
2828
end
2929
s.subspec 'Transfer' do |transfer|
3030
transfer.source_files = 'QCloudCOSXML/Classes/*','QCloudCOSXML/Classes/Transfer/**/*','QCloudCOSXML/Classes/Base/**/*'
31-
transfer.dependency "QCloudCore/WithoutMTA",'6.4.4'
31+
transfer.dependency "QCloudCore/WithoutMTA",'6.4.5'
3232

3333
end
3434

‎QCloudCOSXML/Classes/Base/QCloudCOSXMLEndPoint.m

+12
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,18 @@ - (NSURL *)serverURLWithBucket:(NSString *)bucket appID:(NSString *)appID region
7878
} else {
7979
regionNametmp = self.regionName;
8080
}
81+
82+
if ([self.serviceName isEqualToString:@"myqcloud.com"]) {
83+
NSParameterAssert(regionNametmp);
84+
static NSString *regularExpression = @"[a-zA-Z0-9.-]*";
85+
BOOL isLegal = [regionNametmp matchesRegularExpression:regularExpression];
86+
NSAssert(isLegal, @"Region name contains illegal character! It can only contains a-z, A-Z, 0-9, '.' and '-' ");
87+
if (!isLegal) {
88+
QCloudLogDebug(@"Region %@ contains illeagal character, setter returns immediately", regionName);
89+
return nil;
90+
}
91+
}
92+
8193
NSURL *serverURL;
8294

8395
serverURL = [NSURL URLWithString:[NSString stringWithFormat:@"%@://%@.cos.%@.%@", scheme, formattedBucketName, regionNametmp, self.serviceName]];

‎QCloudCOSXML/Classes/CI/request/QCloudQRCodeRecognitionRequest.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ NS_ASSUME_NONNULL_BEGIN
6060
// result：QCloudRecognitionQRcodeResponse 包含所有的响应；
6161
// 具体查看代码注释或api文档：https://cloud.tencent.com/document/product/460/37513
6262
}];
63-
[[QCloudCOSXMLService defaultCOSXML] RecognitionQRcode:request];
63+
[[QCloudCOSXMLService defaultCOSXML] CIQRCodeRecognition:request];
6464
6565
6666
*/

‎QCloudCOSXML/Classes/Manager/QCloudCOSXMLService+Manager.h

+2
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
@class QCloudDeleteBucketTaggingRequest;
5252

5353
@class QCloudPutBucketInventoryRequest;
54+
@class QCloudPostBucketInventoryRequest;
5455
@class QCloudGetBucketInventoryRequest;
5556
@class QCloudDeleteBucketInventoryRequest;
5657
@class QCloudListBucketInventoryConfigurationsRequest;
@@ -111,6 +112,7 @@ NS_ASSUME_NONNULL_BEGIN
111112
- (void)GetBucketWebsite:(QCloudGetBucketWebsiteRequest *)request;
112113
- (void)DeleteBucketWebsite:(QCloudDeleteBucketWebsiteRequest *)request;
113114
- (void)PutBucketInventory:(QCloudPutBucketInventoryRequest *)request;
115+
- (void)PostBucketInventory:(QCloudPostBucketInventoryRequest *)request;
114116
- (void)GetBucketInventory:(QCloudGetBucketInventoryRequest *)request;
115117
- (void)DeleteBucketInventory:(QCloudDeleteBucketInventoryRequest *)request;
116118
- (void)ListBucketInventory:(QCloudListBucketInventoryConfigurationsRequest *)request;

‎QCloudCOSXML/Classes/Manager/QCloudCOSXMLService+Manager.m

+4
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,10 @@ - (void)PutBucketInventory:(QCloudPutBucketInventoryRequest *)request {
235235
[super performRequest:request];
236236
}
237237

238+
- (void)PostBucketInventory:(QCloudPostBucketInventoryRequest *)request {
239+
[super performRequest:request];
240+
}
241+
238242
- (void)GetBucketInventory:(QCloudGetBucketInventoryRequest *)request {
239243
[super performRequest:request];
240244
}

‎QCloudCOSXML/Classes/Manager/request/QCloudDeleteObjectRequest.m

+12
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ - (instancetype)init {
4343
if (!self) {
4444
return nil;
4545
}
46+
self.objectKeySimplifyCheck = YES;
4647
return self;
4748
}
4849
- (void)configureReuqestSerializer:(QCloudRequestSerializer *)requestSerializer responseSerializer:(QCloudResponseSerializer *)responseSerializer {
@@ -74,6 +75,17 @@ - (BOOL)buildRequestData:(NSError *__autoreleasing *)error {
7475
return NO;
7576
}
7677
}
78+
79+
if (self.objectKeySimplifyCheck && [[self simplifyPath:self.object] isEqualToString:@"/"]) {
80+
if (error != NULL) {
81+
*error = [NSError
82+
qcloud_errorWithCode:QCloudNetworkErrorCodeParamterInvalid
83+
message:[NSString stringWithFormat:
84+
@"The Getobject Key is illegal"]];
85+
return NO;
86+
}
87+
}
88+
7789
if (!self.bucket || ([self.bucket isKindOfClass:NSString.class] && ((NSString *)self.bucket).length == 0)) {
7890
if (error != NULL) {
7991
*error = [NSError

‎QCloudCOSXML/Classes/Manager/request/QCloudPostBucketInventoryRequest.h

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
//
2+
// QCloudPostBucketInventoryRequest.h
3+
// QCloudPostBucketInventoryRequest
4+
//
5+
// Created by tencent
6+
// Copyright (c) 2015年 tencent. All rights reserved.
7+
//
8+
// ██████╗ ██████╗██╗ ██████╗ ██╗ ██╗██████╗ ████████╗███████╗██████╗ ███╗ ███╗██╗███╗ ██╗ █████╗ ██╗ ██╗ █████╗
9+
// ██████╗
10+
// ██╔═══██╗██╔════╝██║ ██╔═══██╗██║ ██║██╔══██╗ ╚══██╔══╝██╔════╝██╔══██╗████╗ ████║██║████╗ ██║██╔══██╗██║ ██║ ██╔══██╗██╔══██╗
11+
// ██║ ██║██║ ██║ ██║ ██║██║ ██║██║ ██║ ██║ █████╗ ██████╔╝██╔████╔██║██║██╔██╗ ██║███████║██║ ██║ ███████║██████╔╝
12+
// ██║▄▄ ██║██║ ██║ ██║ ██║██║ ██║██║ ██║ ██║ ██╔══╝ ██╔══██╗██║╚██╔╝██║██║██║╚██╗██║██╔══██║██║ ██║ ██╔══██║██╔══██╗
13+
// ╚██████╔╝╚██████╗███████╗╚██████╔╝╚██████╔╝██████╔╝ ██║ ███████╗██║ ██║██║ ╚═╝ ██║██║██║ ╚████║██║ ██║███████╗ ███████╗██║
14+
// ██║██████╔╝
15+
// ╚══▀▀═╝ ╚═════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝ ╚══════╝╚═╝ ╚═╝╚═════╝
16+
//
17+
//
18+
// _ __ _ _
19+
// (_) / _| | | | |
20+
// ___ ___ _ ____ ___ ___ ___ | |_ ___ _ __ __| | _____ _____| | ___ _ __ ___ _
21+
// __ ___
22+
// / __|/ _ \ '__\ \ / / |/ __/ _ \ | _/ _ \| '__| / _` |/ _ \ \ / / _ \ |/ _ \| '_ \ / _ \
23+
// '__/ __|
24+
// \__ \ __/ | \ V /| | (_| __/ | || (_) | | | (_| | __/\ V / __/ | (_) | |_) | __/
25+
// | \__
26+
// |___/\___|_| \_/ |_|\___\___| |_| \___/|_| \__,_|\___| \_/ \___|_|\___/| .__/
27+
// \___|_| |___/
28+
// ______ ______ ______ ______ ______ ______ ______ ______ | |
29+
// |______|______|______|______|______|______|______|______| |_|
30+
//
31+
32+
#import <Foundation/Foundation.h>
33+
#import <QCloudCore/QCloudCore.h>
34+
@class QCloudInventoryConfiguration;
35+
NS_ASSUME_NONNULL_BEGIN
36+
/**
37+
38+
用于存储桶创建一个一次性清单任务
39+
40+
### 功能说明
41+
42+
COS 支持在每个存储桶中创建最多1000条清单任务。
43+
44+
POST Bucket inventory 可以对一个存储桶创建一个一次性清单任务。区别于 PUT Bucket inventory，这个清单任务创建后将立即开始执行，每个任务只会执行一次，而不会周期性地重复执行。通过使用此功能，您能够更加灵活地获取到存储桶的对象清单，进而更精细化地管理对象。
45+
46+
关于在存储桶中创建清单任务接口的具体描述，请查看 https://cloud.tencent.com/document/product/436/83382
47+
48+
### 示例
49+
50+
@code
51+
52+
QCloudPostBucketInventoryRequest *putReq = [QCloudPostBucketInventoryRequest new];
53+
54+
// 存储桶名称，格式为 BucketName-APPID
55+
putReq.bucket= @"examplebucket-1250000000";
56+
57+
// 清单任务的名称
58+
putReq.inventoryID = @"list1";
59+
60+
// 用户在请求体中使用 XML 语言设置清单任务的具体配置信息。配置信息包括清单任务分析的对象，
61+
// 分析的频次，分析的维度，分析结果的格式及存储的位置等信息。
62+
QCloudInventoryConfiguration *config = [QCloudInventoryConfiguration new];
63+
64+
// 清单的名称，与请求参数中的 id 对应
65+
config.identifier = @"list1";
66+
67+
// 清单是否启用的标识：
68+
// 如果设置为 true，清单功能将生效
69+
// 如果设置为 false，将不生成任何清单
70+
config.isEnabled = @"True";
71+
72+
// 描述存放清单结果的信息
73+
QCloudInventoryDestination *des = [QCloudInventoryDestination new];
74+
75+
QCloudInventoryBucketDestination *btDes =[QCloudInventoryBucketDestination new];
76+
77+
// 清单分析结果的文件形式，可选项为 CSV 格式
78+
btDes.cs = @"CSV";
79+
80+
// 存储桶的所有者 ID
81+
btDes.account = @"1278687956";
82+
83+
// 存储桶名称，格式为 BucketName-APPID
84+
btDes.bucket = @"qcs::cos:ap-guangzhou::examplebucket-1250000000";
85+
86+
// 清单分析结果的前缀
87+
btDes.prefix = @"list1";
88+
89+
// COS 托管密钥的加密方式
90+
QCloudInventoryEncryption *enc = [QCloudInventoryEncryption new];
91+
enc.ssecos = @"";
92+
93+
// 为清单结果提供服务端加密的选项
94+
btDes.encryption = enc;
95+
96+
// 清单结果导出后存放的存储桶信息
97+
des.bucketDestination = btDes;
98+
99+
// 描述存放清单结果的信息
100+
config.destination = des;
101+
102+
// 配置清单任务周期
103+
QCloudInventorySchedule *sc = [QCloudInventorySchedule new];
104+
105+
// 清单任务周期，可选项为按日或者按周，枚举值：Daily、Weekly
106+
sc.frequency = @"Daily";
107+
config.schedule = sc;
108+
QCloudInventoryFilter *fileter = [QCloudInventoryFilter new];
109+
fileter.prefix = @"myPrefix";
110+
config.filter = fileter;
111+
config.includedObjectVersions = QCloudCOSIncludedObjectVersionsAll;
112+
QCloudInventoryOptionalFields *fields = [QCloudInventoryOptionalFields new];
113+
114+
fields.field = @[ @"Size",
115+
@"LastModifiedDate",
116+
@"ETag",
117+
@"StorageClass",
118+
@"IsMultipartUploaded",
119+
@"ReplicationStatus"];
120+
121+
// 设置清单结果中应包含的分析项目
122+
config.optionalFields = fields;
123+
putReq.inventoryConfiguration = config;
124+
[putReq setFinishBlock:^(id outputObject, NSError *error) {
125+
// 可以从 outputObject 中获取 response 中 etag 或者自定义头部等信息
126+
NSDictionary * result = (NSDictionary *)outputObject;
127+
128+
}];
129+
[[QCloudCOSXMLService defaultCOSXML] PostBucketInventory:putReq];
130+
131+
*/
132+
@interface QCloudPostBucketInventoryRequest : QCloudBizHTTPRequest
133+
/**
134+
说明日志记录配置的状态
135+
*/
136+
@property (strong, nonatomic) QCloudInventoryConfiguration *inventoryConfiguration;
137+
138+
/**
139+
清单任务的名称。缺省值：None；合法字符：a-z，A-Z，0-9，-，_，.
140+
*/
141+
142+
@property (strong, nonatomic) NSString *inventoryID;
143+
/**
144+
存储桶名
145+
*/
146+
@property (strong, nonatomic) NSString *bucket;
147+
148+
@end
149+
NS_ASSUME_NONNULL_END

‎QCloudCOSXML/Classes/Manager/request/QCloudPostBucketInventoryRequest.m

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
//
2+
// QCloudPostBucketInventoryRequest.m
3+
// QCloudPostBucketInventoryRequest
4+
//
5+
// Created by tencent
6+
// Copyright (c) 2015年 tencent. All rights reserved.
7+
//
8+
// ██████╗ ██████╗██╗ ██████╗ ██╗ ██╗██████╗ ████████╗███████╗██████╗ ███╗ ███╗██╗███╗ ██╗ █████╗ ██╗ ██╗ █████╗
9+
// ██████╗
10+
// ██╔═══██╗██╔════╝██║ ██╔═══██╗██║ ██║██╔══██╗ ╚══██╔══╝██╔════╝██╔══██╗████╗ ████║██║████╗ ██║██╔══██╗██║ ██║ ██╔══██╗██╔══██╗
11+
// ██║ ██║██║ ██║ ██║ ██║██║ ██║██║ ██║ ██║ █████╗ ██████╔╝██╔████╔██║██║██╔██╗ ██║███████║██║ ██║ ███████║██████╔╝
12+
// ██║▄▄ ██║██║ ██║ ██║ ██║██║ ██║██║ ██║ ██║ ██╔══╝ ██╔══██╗██║╚██╔╝██║██║██║╚██╗██║██╔══██║██║ ██║ ██╔══██║██╔══██╗
13+
// ╚██████╔╝╚██████╗███████╗╚██████╔╝╚██████╔╝██████╔╝ ██║ ███████╗██║ ██║██║ ╚═╝ ██║██║██║ ╚████║██║ ██║███████╗ ███████╗██║
14+
// ██║██████╔╝
15+
// ╚══▀▀═╝ ╚═════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝ ╚══════╝╚═╝ ╚═╝╚═════╝
16+
//
17+
//
18+
// _ __ _ _
19+
// (_) / _| | | | |
20+
// ___ ___ _ ____ ___ ___ ___ | |_ ___ _ __ __| | _____ _____| | ___ _ __ ___ _
21+
// __ ___
22+
// / __|/ _ \ '__\ \ / / |/ __/ _ \ | _/ _ \| '__| / _` |/ _ \ \ / / _ \ |/ _ \| '_ \ / _ \
23+
// '__/ __|
24+
// \__ \ __/ | \ V /| | (_| __/ | || (_) | | | (_| | __/\ V / __/ | (_) | |_) | __/
25+
// | \__
26+
// |___/\___|_| \_/ |_|\___\___| |_| \___/|_| \__,_|\___| \_/ \___|_|\___/| .__/
27+
// \___|_| |___/
28+
// ______ ______ ______ ______ ______ ______ ______ ______ | |
29+
// |______|______|______|______|______|______|______|______| |_|
30+
//
31+
32+
#import "QCloudPostBucketInventoryRequest.h"
33+
#import <QCloudCore/QCloudSignatureFields.h>
34+
#import <QCloudCore/QCloudCore.h>
35+
#import <QCloudCore/QCloudConfiguration_Private.h>
36+
#import "QCloudInventoryConfiguration.h"
37+
38+
NS_ASSUME_NONNULL_BEGIN
39+
@implementation QCloudPostBucketInventoryRequest
40+
- (void)dealloc {
41+
}
42+
- (instancetype)init {
43+
self = [super init];
44+
if (!self) {
45+
return nil;
46+
}
47+
return self;
48+
}
49+
- (void)configureReuqestSerializer:(QCloudRequestSerializer *)requestSerializer responseSerializer:(QCloudResponseSerializer *)responseSerializer {
50+
NSArray *customRequestSerilizers = @[
51+
QCloudURLFuseURIMethodASURLParamters,
52+
QCloudURLFuseWithXMLParamters,
53+
];
54+
55+
NSArray *responseSerializers = @[
56+
QCloudAcceptRespnseCodeBlock([NSSet setWithObjects:@(200), @(201), @(202), @(203), @(204), @(205), @(206), @(207), @(208), @(226), nil], nil),
57+
58+
QCloudResponseAppendHeadersSerializerBlock,
59+
];
60+
[requestSerializer setSerializerBlocks:customRequestSerilizers];
61+
[responseSerializer setSerializerBlocks:responseSerializers];
62+
63+
requestSerializer.HTTPMethod = @"post";
64+
}
65+
66+
- (BOOL)buildRequestData:(NSError *__autoreleasing *)error {
67+
if (![super buildRequestData:error]) {
68+
return NO;
69+
}
70+
[self.requestData setParameter:[self.inventoryConfiguration qcloud_modelToJSONObject] withKey:@"InventoryConfiguration"];
71+
if (!self.inventoryID || ([self.inventoryID isKindOfClass:NSString.class] && ((NSString *)self.inventoryID).length == 0)) {
72+
if (error != NULL) {
73+
*error = [NSError
74+
qcloud_errorWithCode:QCloudNetworkErrorCodeParamterInvalid
75+
message:[NSString stringWithFormat:@"paramter[inventoryID] is invalid (nil), it must have some value. please check it"]];
76+
return NO;
77+
}
78+
}
79+
[self.requestData setQueryStringParamter:self.inventoryID withKey:@"id"];
80+
if (!self.bucket || ([self.bucket isKindOfClass:NSString.class] && ((NSString *)self.bucket).length == 0)) {
81+
if (error != NULL) {
82+
*error = [NSError
83+
qcloud_errorWithCode:QCloudNetworkErrorCodeParamterInvalid
84+
message:[NSString stringWithFormat:@"paramter[bucket] is invalid (nil), it must have some value. please check it"]];
85+
return NO;
86+
}
87+
}
88+
NSURL *__serverURL = [self.runOnService.configuration.endpoint serverURLWithBucket:self.bucket
89+
appID:self.runOnService.configuration.appID
90+
regionName:self.regionName];
91+
self.requestData.serverURL = __serverURL.absoluteString;
92+
[self.requestData setValue:__serverURL.host forHTTPHeaderField:@"Host"];
93+
self.requestData.URIMethod = @"inventory";
94+
return YES;
95+
}
96+
97+
- (QCloudSignatureFields *)signatureFields {
98+
QCloudSignatureFields *fileds = [QCloudSignatureFields new];
99+
100+
return fileds;
101+
}
102+
103+
@end
104+
NS_ASSUME_NONNULL_END

‎QCloudCOSXML/Classes/QCloudCOSXML/QCloudCOSXML.h

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
#import "QCloudGetBucketTaggingRequest.h"
3131
#import "QCloudDeleteBucketTaggingRequest.h"
3232
#import "QCloudPutBucketInventoryRequest.h"
33+
#import "QCloudPostBucketInventoryRequest.h"
3334
#import "QCloudGetBucketInventoryRequest.h"
3435
#import "QCloudDeleteBucketInventoryRequest.h"
3536
#import "QCloudListBucketInventoryConfigurationsRequest.h"

0 commit comments

Comments
 (0)