Feng Ruohang 938603458d fix: harden CORS and replication request trust ...

Keep pre-authentication CORS lookups resident-only so attacker-controlled path segments cannot trigger metadata I/O or grow the metadata cache. Preserve fail-closed behavior for startup, load failures, invalid metadata, and the internal namespace.

Centralize replication request trust after authentication, distinguish general replication from replica-only privileges, and gate SSE-C ciphertext handling, source metadata, object-lock bypasses, event suppression, delete semantics, and replica status on the appropriate permission. Add least-privilege, multipart, PostPolicy, CORS amplification, and compatibility regressions.

Signed-off-by: Feng Ruohang <rh@vonng.com>

2026-09-01 20:50:08 +08:00

..

lock_test.go

fix: harden CORS and replication request trust

2026-09-01 20:50:08 +08:00

lock.go

fix: harden CORS and replication request trust

2026-09-01 20:50:08 +08:00