Repository: pingcap/tidb
File: pkg/objstore/ossstore/store.go (Go)

Code before:
		WithRetryer(newRetryer()).
		WithLogLevel(getOSSLogLevel()).
		WithLogPrinter(newLogPrinter(logger))

	// TODO OSS charges for traffic, consider auto use internal endpoint when
	// not specified explicitly and the bucket is in the same region with the
	// client.
	if len(qs.Endpoint) != 0 {
		ossCfg = ossCfg.WithEndpoint(qs.Endpoint)
	}
	var (
		ecsRegionID   string
		credRefresher *credentialRefresher
	)
	if qs.AccessKey != "" && qs.SecretAccessKey != "" {
		ossCfg = ossCfg.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(qs.AccessKey, qs.SecretAccessKey, qs.SessionToken))
	} else {
		var provider providers.CredentialsProvider = providers.NewDefaultCredentialsProvider()
		cred, err := provider.GetCredentials()
		if err != nil {
			return nil, errors.Annotatef(err, "failed to get credentials from default provider")
		}
		// the default provider concatenates the provider names with `/`, see
		// https://github.com/aliyun/credentials-go/blob/7d2a3e68402630904f518531e80b370b3649c6a1/credentials/providers/default.go#L101
		if strings.Contains(cred.ProviderName, ecsRAMRoleProviderName) {
			httpCli := &http.Client{}
			ecsRegionID, err = httputil.GetText(httpCli, regionIDMetaURL)
			if err != nil {
				return nil, errors.Annotatef(err, "failed to get region ID from ECS metadata service")
			}
		}
		if qs.RoleArn != "" {
			var err2 error
			provider, err2 = providers.NewRAMRoleARNCredentialsProviderBuilder().
				WithCredentialsProvider(provider).
				WithRoleArn(qs.RoleArn).
				WithExternalId(qs.ExternalId).
				WithHttpOptions(&providers.HttpOptions{
					ReadTimeout:    int(30 * time.Second.Milliseconds()),
					ConnectTimeout: int(30 * time.Second.Milliseconds()),
				}).
				Build()
			if err2 != nil {
				return nil, errors.Trace(err2)
			}
		}
		credRefresher = newCredentialRefresher(provider, logger)
		if err := credRefresher.refreshOnce(); err != nil {
			return nil, errors.Annotatef(err, "failed to get initial OSS credentials")
		}
		ossCfg = ossCfg.WithCredentialsProvider(credRefresher)

Review comment (suggestion):
The HTTP client created here lacks a timeout configuration. The GetText function could potentially hang indefinitely if the metadata service is unresponsive. Consider using httputil.NewClient or setting a reasonable timeout on the HTTP client to prevent indefinite blocking.
```suggestion
			httpCli := httputil.NewClient()
```

Code after:
		WithRetryer(newRetryer()).
		WithLogLevel(getOSSLogLevel()).
		WithLogPrinter(newLogPrinter(logger))

	// TODO OSS charges for traffic, consider auto use internal endpoint when
	// not specified explicitly and the bucket is in the same region with the
	// client.
	if len(qs.Endpoint) != 0 {
		ossCfg = ossCfg.WithEndpoint(qs.Endpoint)
	}
	var (
		ecsRegionID   string
		credRefresher *credentialRefresher
	)
	if qs.AccessKey != "" && qs.SecretAccessKey != "" {
		ossCfg = ossCfg.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(qs.AccessKey, qs.SecretAccessKey, qs.SessionToken))
	} else {
		var provider providers.CredentialsProvider = providers.NewDefaultCredentialsProvider()
		cred, err := provider.GetCredentials()
		if err != nil {
			return nil, errors.Annotatef(err, "failed to get credentials from default provider")
		}
		// the default provider concatenates the provider names with `/`, see
		// https://github.com/aliyun/credentials-go/blob/7d2a3e68402630904f518531e80b370b3649c6a1/credentials/providers/default.go#L101
		if strings.Contains(cred.ProviderName, ecsRAMRoleProviderName) {
			httpCli := httputil.NewClient(nil)
			ecsRegionID, err = httputil.GetText(httpCli, regionIDMetaURL)
			if err != nil {
				// shouldn't happen normally, we just successfully got ECS RAM
				// role credentials from the metadata service.
				return nil, errors.Annotatef(err, "failed to get region ID from ECS metadata service")
			}
		}
		if qs.RoleArn != "" {
			var err2 error
			provider, err2 = providers.NewRAMRoleARNCredentialsProviderBuilder().
				WithCredentialsProvider(provider).
				WithRoleArn(qs.RoleArn).
				WithExternalId(qs.ExternalId).
				WithHttpOptions(&providers.HttpOptions{
					ReadTimeout:    int(30 * time.Second.Milliseconds()),
					ConnectTimeout: int(30 * time.Second.Milliseconds()),
				}).
				Build()
			if err2 != nil {
				return nil, errors.Trace(err2)
			}
		}
		credRefresher = newCredentialRefresher(provider, logger)
		if err := credRefresher.refreshOnce(); err != nil {
			return nil, errors.Annotatef(err, "failed to get initial OSS credentials")