fix: harden CORS and replication request trust

buildscripts/rebrand-guard/compat-baseline.json

@@ -693,6 +693,7 @@
     "/%s/us-east-1/s3/aws4_request",
     "/*",
     "/../../etc",
+    "/../obj",
     "/./abc/def",
     "/.dockerenv",
     "/.trash",
@@ -705,6 +706,7 @@
     "//contains/double-forwardslash-prefix",
     "/?",
     "/?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=USWUXHGYZQYFYFFIT3RE%2F20170529%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20170529T190139Z\u0026X-Amz-Expires=600\u0026X-Amz-Signature=19b58080999df54b446fc97304eb8dda60d3df1812ae97f3e8783351bfd9781d\u0026X-Amz-SignedHeaders=host\u0026prefix=Hello%2AWorld%2A",
+    "/A/obj",
     "/a",
     "/a/b/c",
     "/a/b/c/d/e/f/g",
@@ -721,6 +723,7 @@
     "/admin",
     "/afile",
     "/api/requests",
+    "/api/v1/login",
     "/apis",
     "/audit",
     "/background-heal/status",
@@ -852,6 +855,7 @@
     "/ls",
     "/metrics",
     "/metrics/v3",
+    "/minio/admin/v3/info",
     "/minio/grid/",
     "/minio/grid/lock/",
     "/minio/health/cluster",
@@ -970,6 +974,7 @@
     "/speedtest/site",
     "/start-job",
     "/startprofiling",
+    "/startup-missing/object",
     "/status",
     "/status-job",
     "/storage",
@@ -1020,6 +1025,7 @@
     "/version",
     "/vfile",
     "/wall",
+    "/x/obj",
     "/xl.meta",
     "/{bucket}",
     "/{object:.+}"
@@ -3139,6 +3145,7 @@
     "cmd:cmd:method:BucketMetadataSys.GetPolicyConfig",
     "cmd:cmd:method:BucketMetadataSys.GetQuotaConfig",
     "cmd:cmd:method:BucketMetadataSys.GetReplicationConfig",
+    "cmd:cmd:method:BucketMetadataSys.GetResidentCorsConfig",
     "cmd:cmd:method:BucketMetadataSys.GetSSEConfig",
     "cmd:cmd:method:BucketMetadataSys.GetTaggingConfig",
     "cmd:cmd:method:BucketMetadataSys.GetVersioningConfig",
@@ -10258,6 +10265,10 @@
     "cmd/object-multipart-handlers.go=\"X-Minio-Replication-Server-Side-Encryption-Iv\"",
     "cmd/object-multipart-handlers.go=\"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm\"",
     "cmd/object-multipart-handlers.go=\"X-Minio-Replication-Server-Side-Encryption-Sealed-Key\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Encrypted-Multipart\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Server-Side-Encryption-Iv\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Server-Side-Encryption-Sealed-Key\"",
     "cmd/s3-zip-handlers.go=\"x-minio-extract\"",
     "cmd/server-startup-msg.go=\"https://silo.pgsty.com/reference/minio-mc/#quickstart\"",
     "cmd/storage-rest-server.go=\"X-Minio-Time\"",

cmd/api-router.go

@@ -787,7 +787,16 @@ func corsHandler(handler http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Origin") != "" {
 			if bucket, _ := request2BucketObjectName(r); bucket != "" && globalBucketMetadataSys != nil {
-				cfg, _, err := globalBucketMetadataSys.GetCorsConfig(bucket)
+				// Resident-only lookup: this runs pre-auth for every
+				// Origin-bearing request using a client-supplied path segment as
+				// the bucket name. It must never load or cache metadata for
+				// arbitrary names (see GetResidentCorsConfig). GetResidentCorsConfig
+				// is the single decision point: it returns errInvalidArgument for
+				// the internal .minio.sys namespace (fail closed), a config for a
+				// resident bucket, errBucketMetadataNotInitialized for a real but
+				// unloaded bucket (fail closed), and errConfigNotFound otherwise
+				// (fall back to the global policy below).
+				cfg, _, err := globalBucketMetadataSys.GetResidentCorsConfig(bucket)
 				if err == nil && cfg != nil {
 					if applyBucketCors(w, r, cfg) {
 						return

cmd/auth-handler.go

@@ -786,10 +786,20 @@ func isPutActionAllowedWithRequestTags(ctx context.Context, atype authType, buck
 		return s3Err
 	}
 
-	logger.GetReqInfo(ctx).Cred = cred
-	logger.GetReqInfo(ctx).Owner = owner
-	logger.GetReqInfo(ctx).Region = region
+	reqInfo := logger.GetReqInfo(ctx)
+	if reqInfo == nil {
+		return ErrAccessDenied
+	}
+	reqInfo.Lock()
+	reqInfo.Cred = cred
+	reqInfo.Owner = owner
+	reqInfo.Region = region
+	reqInfo.Unlock()
+
+	return isPutActionAllowedWithCred(bucketName, objectName, r, action, requestTags, cred, owner)
+}
 
+func isPutActionAllowedWithCred(bucketName, objectName string, r *http.Request, action policy.Action, requestTags *string, cred auth.Credentials, owner bool) APIErrorCode {
 	// Do not check for PutObjectRetentionAction permission,
 	// if mode and retain until date are not set.
 	// Can happen when bucket has default lock config set