imageproxy icon indicating copy to clipboard operation
imageproxy copied to clipboard

Treat empty cache objects as misses to prevent poisoning

Open jeremy opened this issue 7 months ago • 0 comments

When using S3 or GCS cache with bucket lifecycle rules to automatically delete old objects, imageproxy can get "poisoned" with empty cache entries. This happens because the cache returns empty data ([]byte{}, true) instead of a cache miss (nil, false), causing httpcache to serve blank responses.

This PR fixes the issue by treating zero-length objects as cache misses in both S3 and GCS cache implementations.

  • Add empty object check in s3cache.Get() and gcscache.Get()
  • Refactor S3 cache to use s3iface.S3API interface for testability
  • Refactor GCS cache to use custom interfaces for testability (bit verbose; mirrors the S3 approach)
  • Add NewWithClient/NewWithBucket constructors for dependency injection
  • Add comprehensive test coverage for both cache implementations, necessary to confirm expected behavior when a cache object is deleted

Fixes #248

/cc @Ladybiss @mdkent

jeremy avatar May 30 '25 21:05 jeremy