Treat empty cache objects as misses to prevent poisoning

internal/gcscache/gcscache.go

@@ -19,8 +19,46 @@
 
 var ctx = context.Background()
 
+// objectHandle interface wraps the methods we use from storage.ObjectHandle
+type objectHandle interface {
+	NewReader(ctx context.Context) (io.ReadCloser, error)
+	NewWriter(ctx context.Context) io.WriteCloser
+	Delete(ctx context.Context) error
+}
+
+// bucketHandle interface wraps the methods we use from storage.BucketHandle
+type bucketHandle interface {
+	Object(name string) objectHandle
+}
+
+// gcsObjectHandle wraps storage.ObjectHandle to implement our interface
+type gcsObjectHandle struct {
+	*storage.ObjectHandle
+}
+
+func (o *gcsObjectHandle) NewReader(ctx context.Context) (io.ReadCloser, error) {
+	return o.ObjectHandle.NewReader(ctx)
+}
+
+func (o *gcsObjectHandle) NewWriter(ctx context.Context) io.WriteCloser {
+	return o.ObjectHandle.NewWriter(ctx)
+}
+
+func (o *gcsObjectHandle) Delete(ctx context.Context) error {
+	return o.ObjectHandle.Delete(ctx)
+}
+
+// gcsBucketHandle wraps storage.BucketHandle to implement our interface
+type gcsBucketHandle struct {
+	*storage.BucketHandle
+}
+
+func (b *gcsBucketHandle) Object(name string) objectHandle {
+	return &gcsObjectHandle{b.BucketHandle.Object(name)}
+}
+
 type cache struct {
-	bucket *storage.BucketHandle
+	bucket bucketHandle
 	prefix string
 }
 
@@ -40,6 +78,12 @@
 		return nil, false
 	}
 
+	// Treat empty objects as cache misses to prevent cache poisoning
+	// when objects are deleted by lifecycle rules
+	if len(value) == 0 {
+		return nil, false
+	}
+
 	return value, true
 }
 
@@ -59,7 +103,7 @@
 	}
 }
 
-func (c *cache) object(key string) *storage.ObjectHandle {
+func (c *cache) object(key string) objectHandle {
 	name := path.Join(c.prefix, keyToFilename(key))
 	return c.bucket.Object(name)
 }
@@ -70,6 +114,14 @@
 	return hex.EncodeToString(h.Sum(nil))
 }
 
+// NewWithBucket constructs a cache using the provided bucket handle
+func NewWithBucket(bucket bucketHandle, prefix string) *cache {
+	return &cache{
+		bucket: bucket,
+		prefix: prefix,
+	}
+}
+
 // New constructs a Cache storing files in the specified GCS bucket.  If prefix
 // is not empty, objects will be prefixed with that path. Credentials should
 // be specified using one of the mechanisms supported for Application Default
@@ -82,6 +134,6 @@
 
 	return &cache{
 		prefix: prefix,
-		bucket: client.Bucket(bucket),
+		bucket: &gcsBucketHandle{client.Bucket(bucket)},
 	}, nil
 }