Linode Object Storage allows creation of ".." prefix for folders @linode/api-v4 Presigned URL #13328
Description
Hello team,
I was working in a custom CLI to work with Linode Object Storage when accidentally found out that I can create folders with .. prefix when using @linode/api-v4 Presigned URL. I have an example where I created by mistake a object key with the following name ../cardinal-stack/LICENSE and uploaded the content to the file as per printscreen:
Through the console I'm unable to delete the file
Steps to reproduce the issue:
1 - Generate Presigned URL for object key https://api.linode.com/v4/object-storage/buckets/{region}/{bucket}/object-url
2 - Put file content through generated Presigned URL
3 - Access the file through the console and try to delete the file
It raises security concerns are in 2 perspectives:
1 - Linode's side, not sure how is the architecture but It can allow injections of malicious file.
2 - User's side, I cannot delete the content of my own so It raises security concerns as well.
Thanks,
OP