Skip to content

Commit 6afd0b1

Browse files
harshavardhanaharshavardhana
authored
avoid leaks during zip download and multi-object downloads (#3481)
1 parent 0b8af38 commit 6afd0b1

File tree

6 files changed

+50
-54
lines changed

6 files changed

+50
-54
lines changed

‎.github/workflows/jobs.yaml

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
runs-on: [ubuntu-latest]
2323
strategy:
2424
matrix:
25-
go-version: [1.22.x]
25+
go-version: [1.23.x]
2626
os: [ubuntu-latest]
2727
steps:
2828
- name: Check out code
@@ -64,7 +64,7 @@ jobs:
6464
runs-on: ubuntu-latest
6565
strategy:
6666
matrix:
67-
go-version: [1.22.x]
67+
go-version: [1.23.x]
6868
os: [ubuntu-latest]
6969
steps:
7070
- name: Check out code
@@ -112,7 +112,7 @@ jobs:
112112
runs-on: [ubuntu-latest]
113113
strategy:
114114
matrix:
115-
go-version: [1.22.x]
115+
go-version: [1.23.x]
116116
steps:
117117
# To build minio image, we need to clone the repository first
118118
- name: Clone github.com/minio/minio
@@ -150,7 +150,7 @@ jobs:
150150
runs-on: ${{ matrix.os }}
151151
strategy:
152152
matrix:
153-
go-version: [1.22.x]
153+
go-version: [1.23.x]
154154
os: [ubuntu-latest]
155155
steps:
156156
- name: Check out code
@@ -189,7 +189,7 @@ jobs:
189189
timeout-minutes: 10
190190
strategy:
191191
matrix:
192-
go-version: [1.22.x]
192+
go-version: [1.23.x]
193193
os: [ubuntu-latest]
194194
steps:
195195
- name: Check out code
@@ -243,7 +243,7 @@ jobs:
243243
timeout-minutes: 10
244244
strategy:
245245
matrix:
246-
go-version: [1.22.x]
246+
go-version: [1.23.x]
247247
os: [ubuntu-latest]
248248
steps:
249249
- name: Check out code
@@ -296,7 +296,7 @@ jobs:
296296
timeout-minutes: 10
297297
strategy:
298298
matrix:
299-
go-version: [1.22.x]
299+
go-version: [1.23.x]
300300
os: [ubuntu-latest]
301301
steps:
302302
- name: Check out code
@@ -348,7 +348,7 @@ jobs:
348348
timeout-minutes: 10
349349
strategy:
350350
matrix:
351-
go-version: [1.22.x]
351+
go-version: [1.23.x]
352352
os: [ubuntu-latest]
353353
steps:
354354
- name: Check out code
@@ -400,7 +400,7 @@ jobs:
400400
timeout-minutes: 15
401401
strategy:
402402
matrix:
403-
go-version: [1.22.x]
403+
go-version: [1.23.x]
404404
os: [ubuntu-latest]
405405
steps:
406406
- name: Check out code
@@ -448,7 +448,7 @@ jobs:
448448
runs-on: [ubuntu-latest]
449449
strategy:
450450
matrix:
451-
go-version: [1.22.x]
451+
go-version: [1.23.x]
452452
os: [ubuntu-latest]
453453
steps:
454454
- name: Check out code
@@ -496,7 +496,7 @@ jobs:
496496
runs-on: [ubuntu-latest]
497497
strategy:
498498
matrix:
499-
go-version: [1.22.x]
499+
go-version: [1.23.x]
500500
os: [ubuntu-latest]
501501
steps:
502502
- name: Check out code
@@ -544,7 +544,7 @@ jobs:
544544
runs-on: [ubuntu-latest]
545545
strategy:
546546
matrix:
547-
go-version: [1.22.x]
547+
go-version: [1.23.x]
548548
os: [ubuntu-latest]
549549
steps:
550550
- name: Check out code
@@ -595,7 +595,7 @@ jobs:
595595
runs-on: [ubuntu-latest]
596596
strategy:
597597
matrix:
598-
go-version: [1.22.x]
598+
go-version: [1.23.x]
599599
os: [ubuntu-latest]
600600
steps:
601601
- name: Check out code
@@ -648,7 +648,7 @@ jobs:
648648
runs-on: ${{ matrix.os }}
649649
strategy:
650650
matrix:
651-
go-version: [1.22.x]
651+
go-version: [1.23.x]
652652
os: [ubuntu-latest]
653653
steps:
654654
- name: Check out code
@@ -683,7 +683,7 @@ jobs:
683683
runs-on: ${{ matrix.os }}
684684
strategy:
685685
matrix:
686-
go-version: [1.22.x]
686+
go-version: [1.23.x]
687687
os: [ubuntu-latest]
688688
steps:
689689
- name: Check out code
@@ -720,7 +720,7 @@ jobs:
720720

721721
strategy:
722722
matrix:
723-
go-version: [1.22.x]
723+
go-version: [1.23.x]
724724

725725
steps:
726726
- name: Check out code
@@ -817,7 +817,7 @@ jobs:
817817

818818
strategy:
819819
matrix:
820-
go-version: [1.22.x]
820+
go-version: [1.23.x]
821821

822822
steps:
823823
- name: Check out code
@@ -867,7 +867,7 @@ jobs:
867867
echo "replace github.com/minio/console => ../" >> go.mod
868868
869869
echo "updates to go.mod needed; to update it: go mod tidy"
870-
go mod tidy -compat=1.22
870+
go mod tidy -compat=1.23
871871
872872
echo "Get git version to build MinIO Image";
873873
VERSION=`git rev-parse HEAD`;
@@ -901,7 +901,7 @@ jobs:
901901
runs-on: ${{ matrix.os }}
902902
strategy:
903903
matrix:
904-
go-version: [1.22.x]
904+
go-version: [1.23.x]
905905
os: [ubuntu-latest]
906906
steps:
907907
- name: Check out code
@@ -956,7 +956,7 @@ jobs:
956956
echo "download golang x tools"
957957
go mod download golang.org/x/tools
958958
echo "go mod tidy compat mode"
959-
go mod tidy -compat=1.22
959+
go mod tidy -compat=1.23
960960
echo "go build gocoverage.go"
961961
go build gocovmerge.go
962962
echo "put together the outs for final coverage resolution"
@@ -1027,7 +1027,7 @@ jobs:
10271027
runs-on: ubuntu-latest
10281028
strategy:
10291029
matrix:
1030-
go-version: [1.22.x]
1030+
go-version: [1.23.x]
10311031
os: [ubuntu-latest]
10321032
steps:
10331033
- name: Check out code
@@ -1069,7 +1069,7 @@ jobs:
10691069
runs-on: ${{ matrix.os }}
10701070
strategy:
10711071
matrix:
1072-
go-version: [1.22.x]
1072+
go-version: [1.23.x]
10731073
os: [ubuntu-latest]
10741074
steps:
10751075
- name: Check out code
@@ -1109,7 +1109,7 @@ jobs:
11091109
runs-on: ${{ matrix.os }}
11101110
strategy:
11111111
matrix:
1112-
go-version: [1.22.x]
1112+
go-version: [1.23.x]
11131113
os: [ubuntu-latest]
11141114
steps:
11151115
- name: Check out code
@@ -1137,7 +1137,7 @@ jobs:
11371137
runs-on: ${{ matrix.os }}
11381138
strategy:
11391139
matrix:
1140-
go-version: [1.22.x]
1140+
go-version: [1.23.x]
11411141
os: [ubuntu-latest]
11421142
steps:
11431143
- name: Check out code
@@ -1164,7 +1164,7 @@ jobs:
11641164
runs-on: ${{ matrix.os }}
11651165
strategy:
11661166
matrix:
1167-
go-version: [1.22.x]
1167+
go-version: [1.23.x]
11681168
os: [ubuntu-latest]
11691169
steps:
11701170
- name: Check out code
@@ -1192,7 +1192,7 @@ jobs:
11921192
runs-on: ${{ matrix.os }}
11931193
strategy:
11941194
matrix:
1195-
go-version: [1.22.x]
1195+
go-version: [1.23.x]
11961196
os: [ubuntu-latest]
11971197
steps:
11981198
- name: Check out code
@@ -1220,7 +1220,7 @@ jobs:
12201220
runs-on: ${{ matrix.os }}
12211221
strategy:
12221222
matrix:
1223-
go-version: [1.22.x]
1223+
go-version: [1.23.x]
12241224
os: [ubuntu-latest]
12251225
steps:
12261226
- name: Check out code

‎.github/workflows/vulncheck.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
- name: Set up Go
2020
uses: actions/setup-go@v5
2121
with:
22-
go-version: 1.22
22+
go-version: 1.23.3
2323
check-latest: true
2424
- name: Get official govulncheck
2525
run: go install golang.org/x/vuln/cmd/govulncheck@latest
@@ -33,7 +33,7 @@ jobs:
3333
runs-on: ubuntu-latest
3434
strategy:
3535
matrix:
36-
go-version: [ 1.22 ]
36+
go-version: [ 1.23.x ]
3737
os: [ ubuntu-latest ]
3838
steps:
3939
- name: Check out code

‎README.md

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -25,21 +25,7 @@ A graphical user interface for [MinIO](https://github.com/minio/minio)
2525

2626
<!-- markdown-toc end -->
2727

28-
## Install
29-
3028
MinIO Console is a library that provides a management and browser UI overlay for the MinIO Server.
31-
The standalone binary installation path has been removed.
32-
33-
In case a Console standalone binary is needed, it can be generated by building this package from source as follows:
34-
35-
### Build from source
36-
37-
> You will need a working Go environment. Therefore, please follow [How to install Go](https://golang.org/doc/install).
38-
> Minimum version required is go1.22
39-
40-
```
41-
go install github.com/minio/console/cmd/console@latest
42-
```
4329

4430
## Setup
4531

‎api/user_objects.go

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -550,10 +550,13 @@ func getDownloadFolderResponse(session *models.Principal, params objectApi.Downl
550550
Modified: modified,
551551
})
552552
if err != nil {
553+
object.Close()
553554
// Ignore errors, move to next
554555
continue
555556
}
557+
556558
_, err = io.Copy(f, object)
559+
object.Close()
557560
if err != nil {
558561
// We have a partial object, report error.
559562
pw.CloseWithError(err)
@@ -650,14 +653,17 @@ func getMultipleFilesDownloadResponse(session *models.Principal, params objectAp
650653
// Ignore errors, move to next
651654
continue
652655
}
653-
modified, _ := time.Parse(time.RFC3339, obj.LastModified)
654656

657+
modified, _ := time.Parse(time.RFC3339, obj.LastModified)
655658
f, err := addToZip(name, modified)
656659
if err != nil {
660+
object.Close()
657661
// Ignore errors, move to next
658662
continue
659663
}
664+
660665
_, err = io.Copy(f, object)
666+
object.Close()
661667
if err != nil {
662668
// We have a partial object, report error.
663669
pw.CloseWithError(err)
@@ -666,13 +672,14 @@ func getMultipleFilesDownloadResponse(session *models.Principal, params objectAp
666672
}
667673

668674
} else {
669-
// add selected individual object
670-
objectData, err := mClient.StatObject(ctx, params.BucketName, dObj, minio.StatObjectOptions{})
675+
object, err := mClient.GetObject(ctx, params.BucketName, dObj, minio.GetObjectOptions{})
671676
if err != nil {
672677
// Ignore errors, move to next
673678
continue
674679
}
675-
object, err := mClient.GetObject(ctx, params.BucketName, dObj, minio.GetObjectOptions{})
680+
681+
// add selected individual object
682+
objectData, err := object.Stat()
676683
if err != nil {
677684
// Ignore errors, move to next
678685
continue
@@ -683,10 +690,13 @@ func getMultipleFilesDownloadResponse(session *models.Principal, params objectAp
683690
objectName := prefixes[len(prefixes)-1]
684691
f, err := addToZip(objectName, objectData.LastModified)
685692
if err != nil {
693+
object.Close()
686694
// Ignore errors, move to next
687695
continue
688696
}
697+
689698
_, err = io.Copy(f, object)
699+
object.Close()
690700
if err != nil {
691701
// We have a partial object, report error.
692702
pw.CloseWithError(err)

‎go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/minio/console
22

3-
go 1.22
3+
go 1.23
44

55
require (
66
github.com/blang/semver/v4 v4.0.0
@@ -24,6 +24,7 @@ require (
2424
github.com/minio/madmin-go/v3 v3.0.68
2525
github.com/minio/mc v0.0.0-20240815155011-479171e7be9c
2626
github.com/minio/minio-go/v7 v7.0.81-0.20241125171916-a563333c01ef
27+
github.com/minio/pkg/v3 v3.0.22
2728
github.com/minio/selfupdate v0.6.0
2829
github.com/minio/websocket v1.6.0
2930
github.com/mitchellh/go-homedir v1.1.0
@@ -35,14 +36,13 @@ require (
3536
golang.org/x/crypto v0.28.0
3637
golang.org/x/net v0.30.0
3738
golang.org/x/oauth2 v0.22.0
39+
3840
// Added to include security fix for
3941
// https://github.com/golang/go/issues/56152
4042
golang.org/x/text v0.19.0 // indirect
4143
gopkg.in/yaml.v2 v2.4.0 // indirect
4244
)
4345

44-
require github.com/minio/pkg/v3 v3.0.22
45-
4646
require (
4747
aead.dev/mem v0.2.0 // indirect
4848
aead.dev/minisign v0.3.0 // indirect

0 commit comments

Comments
 (0)