if err := stream.Skip(); err != nil {
					return fmt.Errorf("stream skip: %w", err)
				}
				continue
			}
			return fmt.Errorf("next stream: %w", err)
		}
		if strings.Contains(stream.Name, "..") || !utf8.ValidString(stream.Name) {
			return fmt.Errorf("invalid stream name: %q", stream.Name)
		}

		dst := filepath.Join(extractDir, stream.Name)
		os.Mkdir(extractDir, 0o755)
		w, err := os.Create(dst)
		if err != nil {

	for segment := range strings.SplitSeq(value, "/") {
		if segment == "." || segment == ".." {
			return &ErrInvalidFilterValue{value}
		}
	}

	if len(value) <= 1024 && utf8.ValidString(value) && !strings.Contains(value, `\`) {
		return nil
	}

	return &ErrInvalidFilterValue{value}
}

// FilterRule - represents elements inside <FilterRule>...</FilterRule>
type FilterRule struct {

// Its valid to have a empty prefix.
func IsValidObjectPrefix(object string) bool {
	if hasBadPathComponent(object) {
		return false
	}
	if !utf8.ValidString(object) {
		return false
	}
	if strings.Contains(object, `//`) {
		return false
	}
	// This is valid for AWS S3 but it will never
	// work with file systems, we will reject here

	if !exists && hasSpaceBE(accessKey) {
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminResourceInvalidArgument), r.URL)
		return
	}

	if !utf8.ValidString(accessKey) {
		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAddUserValidUTF), r.URL)
		return
	}

	checkDenyOnly := accessKey == cred.AccessKey

	if !globalIAMSys.IsAllowed(policy.Args{