Yasuke/moto
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Implemented recognizing asterisks in Actions in policy statements.

Browse Source
This commit is contained in:
acsbendi 2019-07-02 19:24:45 +02:00
parent 6061d5d521
commit 7ec8f85438
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
moto/core/authentication.py
View File

@ -1,4 +1,5 @@
import json import json
import re
from enum import Enum from enum import Enum
from botocore.auth import SigV4Auth from botocore.auth import SigV4Auth
@ -160,10 +161,10 @@ class IAMPolicyStatement:
is_action_concerned = False is_action_concerned = False
if "NotAction" in self._statement: if "NotAction" in self._statement:
if not self._check_element_contains("NotAction", action): if not self._check_element_matches("NotAction", action):
is_action_concerned = True is_action_concerned = True
else: # Action is present else: # Action is present
if self._check_element_contains("Action", action): if self._check_element_matches("Action", action):
is_action_concerned = True is_action_concerned = True
# TODO: check Resource/NotResource and Condition # TODO: check Resource/NotResource and Condition
@ -176,11 +177,20 @@ class IAMPolicyStatement:
else: else:
return PermissionResult.NEUTRAL return PermissionResult.NEUTRAL
def _check_element_contains(self, statement_element, value): def _check_element_matches(self, statement_element, value):
if isinstance(self._statement[statement_element], list): if isinstance(self._statement[statement_element], list):
return value in self._statement[statement_element] for statement_element_value in self._statement[statement_element]:
if self._match(statement_element_value, value):
return True
return False
else: # string else: # string
return value == self._statement[statement_element] return self._match(self._statement[statement_element], value)
@staticmethod
def _match(pattern, string):
pattern = pattern.replace("*", ".*")
pattern = f"^{pattern}$"
return re.match(pattern, string)
class PermissionResult(Enum): class PermissionResult(Enum):