gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-19 19:16:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(runtime): remove high-impact unwrap paths (#3755)

Browse Source 
* fix(runtime): remove high-impact unwrap paths

* fix(runtime): propagate managed SSE metadata errors

* fix(runtime): add typed OPA config errors

* fix(runtime): harden config and credential helpers

* fix(runtime): remove SSE hmac unwraps

* fix(runtime): complete SSE helper error propagation

* fix(trusted-proxies): avoid legacy global init panics

* test(credentials): allow deprecated rpc token check

* fix(storage): harden object lock retention parsing

* chore(checks): refresh layer dependency baseline

* chore(checks): refresh layer dependency baseline

* Update layer-dependency-baseline.txt

Signed-off-by: houseme <housemecn@gmail.com>

* test(context): avoid clone on copy boot time

---------

Signed-off-by: houseme <housemecn@gmail.com>
Co-authored-by: Zhengchao An <anzhengchao@gmail.com>
Co-authored-by: heihutu <heihutu@gmail.com>
This commit is contained in:
houseme
2026-06-23 15:12:47 +08:00
committed by GitHub
parent 825c01060c
commit e42c6df0e8
10 changed files with 240 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/credentials/src/credentials.rs
+13 -2
View File
@@ -243,7 +243,9 @@ fn derive_rpc_secret(access_key: &str, secret_key: &str) -> Option<String> {
return None;
}
let mut mac = <HmacSha256 as KeyInit>::new_from_slice(secret_key.as_bytes()).expect("HMAC can take key of any size");
let Ok(mut mac) = <HmacSha256 as KeyInit>::new_from_slice(secret_key.as_bytes()) else {
return None;
};
mac.update(RPC_SECRET_DERIVATION_CONTEXT);
mac.update(&[0]);
mac.update(access_key.as_bytes());
@@ -284,7 +286,7 @@ pub fn try_get_rpc_token() -> std::io::Result<String> {
#[deprecated(note = "use try_get_rpc_token to handle missing RPC secrets explicitly")]
pub fn get_rpc_token() -> String {
try_get_rpc_token().expect(RPC_SECRET_REQUIRED_MESSAGE)
try_get_rpc_token().unwrap_or_default()
}
/// A wrapper struct for masking sensitive strings in Debug implementations.
@@ -596,6 +598,15 @@ mod tests {
assert_string_return(get_rpc_token);
}
#[allow(deprecated)]
#[test]
fn test_get_rpc_token_matches_fallible_api_contract() {
match try_get_rpc_token() {
Ok(secret) => assert_eq!(get_rpc_token(), secret),
Err(_) => assert_eq!(get_rpc_token(), ""),
}
}
#[test]
fn test_resolve_rpc_secret_accepts_non_default_secret() {
assert_eq!(