astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-10-31 21:02:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: keep the CORS lookup fail-closed until bucket metadata is loaded

Browse Source 
Restore the startup guard removed by the previous cleanup: while bucket
metadata is still loading, a non-resident name may be a bucket with a
restrictive CORS document, so the request gets no CORS answer instead of the
global policy. After startup a non-resident name still falls back to the
global policy without any metadata I/O; the separate load-failure set stays
removed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvgysXDmhPBBimCReYtA8q
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-09-02 18:49:17 +08:00
parent 21646eebd2
commit ec2979ca48
3 changed files with 18 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/bucket-metadata-sys.go
+9 -4
View File
@@ -400,18 +400,23 @@ func (sys *BucketMetadataSys) GetSSEConfig(bucket string) (*bucketsse.BucketSSEC
// GetResidentCorsConfig returns the CORS configuration of a bucket whose
// metadata is already resident in memory. It runs before authentication for
// every Origin-bearing request with a client-supplied path segment, so it
// never loads or caches metadata. A name that is not resident, including any
// real bucket while startup loading is still in progress, reports
// errConfigNotFound and the caller applies the global CORS policy exactly as
// releases without per-bucket CORS did.
// never loads or caches metadata. Until startup loading has completed, a
// non-resident name may still be a bucket with a restrictive document, so it
// reports errBucketMetadataNotInitialized and gets no CORS answer. After
// that, a non-resident name reports errConfigNotFound and the caller applies
// the global CORS policy exactly as releases without per-bucket CORS did.
func (sys *BucketMetadataSys) GetResidentCorsConfig(bucket string) (*cors.Config, time.Time, error) {
if isReservedOrInvalidBucket(bucket, true) {
return nil, time.Time{}, errConfigNotFound
}
sys.RLock()
meta, ok := sys.metadataMap[bucket]
initialized := sys.initialized
sys.RUnlock()
if !ok {
if !initialized {
return nil, time.Time{}, errBucketMetadataNotInitialized
}
return nil, time.Time{}, errConfigNotFound
}
if meta.corsConfigErr != nil {