Enforce limit when deleting multiple objects

Found via s3-tests.
gaul · Sep 3, 2024 · 3d2beb3 · 3d2beb3
1 parent 96da766
commit 3d2beb3
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/main/java/org/gaul/s3proxy/S3ProxyHandler.java b/src/main/java/org/gaul/s3proxy/S3ProxyHandler.java
@@ -1589,6 +1589,10 @@ private void handleMultiBlobRemove(HttpServletRequest request,
             throw new S3Exception(S3ErrorCode.MALFORMED_X_M_L);
         }
 
+        if (dmor.objects.size() > 1_000) {
+            throw new S3Exception(S3ErrorCode.INVALID_ARGUMENT);
+        }
+
         Collection<String> blobNames = new ArrayList<>();
         for (DeleteMultipleObjectsRequest.S3Object s3Object :
                 dmor.objects) {