Handle empty retention in get/put object retention (#9948)

Fixes #9943

cmd/object-handlers.go

@@ -2844,8 +2844,13 @@ func (api objectAPIHandlers) PutObjectRetentionHandler(w http.ResponseWriter, r
 		return
 	}
 
+	if objRetention.Mode.Valid() {
 		objInfo.UserDefined[strings.ToLower(xhttp.AmzObjectLockMode)] = string(objRetention.Mode)
 		objInfo.UserDefined[strings.ToLower(xhttp.AmzObjectLockRetainUntilDate)] = objRetention.RetainUntilDate.UTC().Format(time.RFC3339)
+	} else {
+		delete(objInfo.UserDefined, strings.ToLower(xhttp.AmzObjectLockRetainUntilDate))
+		delete(objInfo.UserDefined, strings.ToLower(xhttp.AmzObjectLockMode))
+	}
 	if objInfo.UserTags != "" {
 		objInfo.UserDefined[xhttp.AmzObjectTagging] = objInfo.UserTags
 	}
@@ -2914,6 +2919,11 @@ func (api objectAPIHandlers) GetObjectRetentionHandler(w http.ResponseWriter, r
 
 	retention := objectlock.GetObjectRetentionMeta(objInfo.UserDefined)
 
+	if !retention.Mode.Valid() {
+		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrNoSuchObjectLockConfiguration), r.URL, guessIsBrowserReq(r))
+		return
+	}
+
 	writeSuccessResponseXML(w, encodeResponse(retention))
 	// Notify object retention accessed via a GET request.
 	sendEvent(eventArgs{

pkg/bucket/object/lock/lock.go

@@ -341,6 +341,14 @@ func ParseObjectRetention(reader io.Reader) (*ObjectRetention, error) {
 		return &ret, ErrUnknownWORMModeDirective
 	}
 
+	if ret.Mode.Valid() && ret.RetainUntilDate.IsZero() {
+		return &ret, ErrMalformedXML
+	}
+
+	if !ret.Mode.Valid() && !ret.RetainUntilDate.IsZero() {
+		return &ret, ErrMalformedXML
+	}
+
 	t, err := UTCNowNTP()
 	if err != nil {
 		logger.LogIf(context.Background(), err)
@@ -431,7 +439,10 @@ func GetObjectRetentionMeta(meta map[string]string) ObjectRetention {
 	}
 	if ok {
 		mode = parseRetMode(modeStr)
+	} else {
+		return ObjectRetention{}
 	}
+
 	tillStr, ok = meta[strings.ToLower(AmzObjectLockRetainUntilDate)]
 	if !ok {
 		tillStr, ok = meta[AmzObjectLockRetainUntilDate]