From 5594d284fc880b14ee1179fa4cb37e34ba44e0d5 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 2 Sep 2026 14:06:56 +0800 Subject: [PATCH] chore: remove dead code left by earlier fixes checkSSECCopySourceKey duplicated the source-key authentication that both CopyObject read paths already perform; the DeleteObjects signature-error branch became unreachable once signatures are verified once per request; the discrete PostgreSQL and MySQL notification environment constants have had no reader since DSNs became mandatory. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01PvgysXDmhPBBimCReYtA8q Signed-off-by: Feng Ruohang --- cmd/bucket-handlers.go | 4 ---- cmd/encryption-v1.go | 23 ----------------------- cmd/object-handlers.go | 11 ----------- internal/event/target/mysql.go | 5 ----- internal/event/target/postgresql.go | 5 ----- 5 files changed, 48 deletions(-) diff --git a/cmd/bucket-handlers.go b/cmd/bucket-handlers.go index c427e082b..e82d61925 100644 --- a/cmd/bucket-handlers.go +++ b/cmd/bucket-handlers.go @@ -509,10 +509,6 @@ func (api objectAPIHandlers) DeleteMultipleObjectsHandler(w http.ResponseWriter, reqInfo.ObjectName = object.ObjectName reqInfo.VersionID = object.VersionID if apiErrCode := authorizeRequest(ctx, r, deleteObjectAction(object.VersionID)); apiErrCode != ErrNone { - if apiErrCode == ErrSignatureDoesNotMatch || apiErrCode == ErrInvalidAccessKeyID { - writeErrorResponse(ctx, w, errorCodes.ToAPIErr(apiErrCode), r.URL) - return - } apiErr := errorCodes.ToAPIErr(apiErrCode) deleteResults[index].errInfo = DeleteError{ Code: apiErr.Code, diff --git a/cmd/encryption-v1.go b/cmd/encryption-v1.go index 2da9d229f..32710915c 100644 --- a/cmd/encryption-v1.go +++ b/cmd/encryption-v1.go @@ -355,29 +355,6 @@ func rotateKey(ctx context.Context, oldKey []byte, newKeyID string, newKey []byt } } -// checkSSECCopySourceKey authenticates the SSE-C copy source key against the -// sealed object key held in metadata. This keeps the diverted rotation safe on -// its own and remains defense in depth when the read path also authenticates -// zero-byte objects. Mirrors the errors rotateKey reports. -func checkSSECCopySourceKey(h http.Header, metadata map[string]string, bucket, object string, newKey []byte) error { - oldKey, err := ParseSSECopyCustomerRequest(h, metadata) - if err != nil { - return err - } - sealedKey, err := crypto.SSEC.ParseMetadata(metadata) - if err != nil { - return err - } - var objectKey crypto.ObjectKey - if err := objectKey.Unseal(oldKey, sealedKey, crypto.SSEC.String(), bucket, object); err != nil { - if subtle.ConstantTimeCompare(oldKey, newKey) == 1 { - return errInvalidSSEParameters - } - return crypto.ErrInvalidCustomerKey - } - return nil -} - func newEncryptMetadata(ctx context.Context, kind crypto.Type, keyID string, key []byte, bucket, object string, metadata map[string]string, cryptoCtx kms.Context) (crypto.ObjectKey, error) { var sealedKey crypto.SealedKey switch kind { diff --git a/cmd/object-handlers.go b/cmd/object-handlers.go index 921469e96..78a3347e6 100644 --- a/cmd/object-handlers.go +++ b/cmd/object-handlers.go @@ -1515,17 +1515,6 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re canRotateKeyInPlace := !srcInfo.Legacy && !copyRewritesObjectData(srcInfo.metadataOnly, copySrcOpts, dstOpts) - // The rotation shortcut authenticates the source key by unsealing it. The - // re-encrypting fallback authenticates it only through the source decryptor, - // which GetObjectNInfo skips for a zero byte object, so check it here before - // the destination is written under the new key. - if cpSrcDstSame && sseCopyC && sseC && !chStorageClass && !canRotateKeyInPlace { - if err := checkSSECCopySourceKey(r.Header, srcInfo.UserDefined, srcBucket, srcObject, newKey); err != nil { - writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL) - return - } - } - // If src == dst and either // - the object is encrypted using SSE-C and two different SSE-C keys are present // - the object is encrypted using SSE-S3 and the SSE-S3 header is present diff --git a/internal/event/target/mysql.go b/internal/event/target/mysql.go index 0f311232a..53b379430 100644 --- a/internal/event/target/mysql.go +++ b/internal/event/target/mysql.go @@ -72,11 +72,6 @@ const ( EnvMySQLFormat = "MINIO_NOTIFY_MYSQL_FORMAT" EnvMySQLDSNString = "MINIO_NOTIFY_MYSQL_DSN_STRING" EnvMySQLTable = "MINIO_NOTIFY_MYSQL_TABLE" - EnvMySQLHost = "MINIO_NOTIFY_MYSQL_HOST" - EnvMySQLPort = "MINIO_NOTIFY_MYSQL_PORT" - EnvMySQLUsername = "MINIO_NOTIFY_MYSQL_USERNAME" - EnvMySQLPassword = "MINIO_NOTIFY_MYSQL_PASSWORD" - EnvMySQLDatabase = "MINIO_NOTIFY_MYSQL_DATABASE" EnvMySQLQueueLimit = "MINIO_NOTIFY_MYSQL_QUEUE_LIMIT" EnvMySQLQueueDir = "MINIO_NOTIFY_MYSQL_QUEUE_DIR" EnvMySQLMaxOpenConnections = "MINIO_NOTIFY_MYSQL_MAX_OPEN_CONNECTIONS" diff --git a/internal/event/target/postgresql.go b/internal/event/target/postgresql.go index 228a2720c..ed5e16c0e 100644 --- a/internal/event/target/postgresql.go +++ b/internal/event/target/postgresql.go @@ -69,11 +69,6 @@ const ( EnvPostgresFormat = "MINIO_NOTIFY_POSTGRES_FORMAT" EnvPostgresConnectionString = "MINIO_NOTIFY_POSTGRES_CONNECTION_STRING" EnvPostgresTable = "MINIO_NOTIFY_POSTGRES_TABLE" - EnvPostgresHost = "MINIO_NOTIFY_POSTGRES_HOST" - EnvPostgresPort = "MINIO_NOTIFY_POSTGRES_PORT" - EnvPostgresUsername = "MINIO_NOTIFY_POSTGRES_USERNAME" - EnvPostgresPassword = "MINIO_NOTIFY_POSTGRES_PASSWORD" - EnvPostgresDatabase = "MINIO_NOTIFY_POSTGRES_DATABASE" EnvPostgresQueueDir = "MINIO_NOTIFY_POSTGRES_QUEUE_DIR" EnvPostgresQueueLimit = "MINIO_NOTIFY_POSTGRES_QUEUE_LIMIT" EnvPostgresMaxOpenConnections = "MINIO_NOTIFY_POSTGRES_MAX_OPEN_CONNECTIONS"