CLDSRV-909: Reject CopyObject when source exceeds 5 GiB

lib/api/objectCopy.js

@@ -641,6 +641,19 @@ function objectCopy(authInfo, request, sourceBucket, sourceObject, sourceVersion
                             request.sourceServerAccessLog && (request.sourceServerAccessLog.error = err);
                             return next(err, destBucketMD);
                         }
+                        const sourceSize = parseInt(sourceObjMD['content-length'], 10);
+                        if (sourceSize > constants.maximumAllowedUploadSize && !config.bypassMaxPutObjectSize) {
+                            log.debug('copy source object too large', { sourceSize });
+                            const err = errorInstances.InvalidRequest.customizeDescription(
+                                'The specified copy source is larger than the maximum ' +
+                                    `allowable size for a copy source: ${constants.maximumAllowedUploadSize}`,
+                            );
+                            if (request.sourceServerAccessLog) {
+                                // eslint-disable-next-line no-param-reassign
+                                request.sourceServerAccessLog.error = err;
+                            }
+                            return next(err, destBucketMD);
+                        }
                         const headerValResult = validateHeaders(
                             request.headers,
                             sourceObjMD['last-modified'],

tests/unit/api/objectCopy.js

@@ -16,7 +16,8 @@ const mpuUtils = require('../utils/mpuUtils');
 const metadata = require('../metadataswitch');
 const { data } = require('../../../lib/data/wrapper');
 const kms = require('../../../lib/kms/wrapper');
-const { objectLocationConstraintHeader } = require('../../../constants');
+const constants = require('../../../constants');
+const { objectLocationConstraintHeader } = constants;
 const { algorithms } = require('../../../lib/api/apiUtils/integrity/validateChecksums');
 const { fakeMetadataArchive } = require('../../functional/aws-node-sdk/test/utils/init');
 const { config } = require('../../../lib/Config');
@@ -1865,3 +1866,61 @@ describe('_orphanedDataLocations', () => {
         assert.deepStrictEqual(orphanedDataLocations(['oldKey'], [{ key: 'newKey' }]), ['oldKey']);
     });
 });
+
+describe('objectCopy source size limit', () => {
+    const testPutObjectRequest = versioningTestUtils.createPutObjectRequest(sourceBucketName, objectKey, objData[0]);
+    const sourceSize = objData[0].length;
+    let originalMaximumUploadSize;
+
+    before(done => {
+        cleanup();
+        originalMaximumUploadSize = constants.maximumAllowedUploadSize;
+        async.series(
+            [
+                callback => bucketPut(authInfo, putDestBucketRequest, log, callback),
+                callback => bucketPut(authInfo, putSourceBucketRequest, log, callback),
+                callback => objectPut(authInfo, testPutObjectRequest, undefined, log, callback),
+            ],
+            done,
+        );
+    });
+
+    after(() => {
+        constants.maximumAllowedUploadSize = originalMaximumUploadSize;
+        config.bypassMaxPutObjectSize = false;
+        cleanup();
+    });
+
+    it('should allow CopyObject when source size equals the limit', done => {
+        constants.maximumAllowedUploadSize = sourceSize;
+        const testObjectCopyRequest = _createObjectCopyRequest(destBucketName);
+        objectCopy(authInfo, testObjectCopyRequest, sourceBucketName, objectKey, undefined, log, err => {
+            assert.ifError(err);
+            done();
+        });
+    });
+
+    it('should reject CopyObject when source size exceeds the limit', done => {
+        constants.maximumAllowedUploadSize = sourceSize - 1;
+        const testObjectCopyRequest = _createObjectCopyRequest(destBucketName);
+        objectCopy(authInfo, testObjectCopyRequest, sourceBucketName, objectKey, undefined, log, err => {
+            assert(err);
+            assert.strictEqual(err.is.InvalidRequest, true);
+            assert.match(
+                err.description,
+                /The specified copy source is larger than the maximum allowable size for a copy source/,
+            );
+            done();
+        });
+    });
+
+    it('should allow CopyObject when source size exceeds the limit but bypass flag is set', done => {
+        constants.maximumAllowedUploadSize = sourceSize - 1;
+        config.bypassMaxPutObjectSize = true;
+        const testObjectCopyRequest = _createObjectCopyRequest(destBucketName);
+        objectCopy(authInfo, testObjectCopyRequest, sourceBucketName, objectKey, undefined, log, err => {
+            assert.ifError(err);
+            done();
+        });
+    });
+});