fix: return MalformedXML for a DeleteObjects request without objects

A DeleteObjects request whose Delete element names no objects was
answered with 200 and an empty DeleteResult. S3 rejects it with
MalformedXML, as the schema requires at least one Object.

Reject the empty list right after the body is parsed, next to the
1000 key limit check. Update the unit and integration tests that
expected the empty result and enable the REST test that covers it.

Fixes #2109

s3api/controllers/bucket-post.go

@@ -57,6 +57,17 @@ func (c S3ApiController) DeleteObjects(ctx fiber.Ctx) (*Response, error) {
 		}, s3err.GetAPIError(s3err.ErrInvalidRequest)
 	}
 
+	// S3 requires at least one object in a DeleteObjects request and
+	// rejects an empty delete list as malformed.
+	if len(dObj.Objects) == 0 {
+		debuglogger.Logf("delete objects: no keys in the request")
+		return &Response{
+			MetaOpts: &MetaOptions{
+				BucketOwner: parsedAcl.Owner,
+			},
+		}, s3err.GetAPIError(s3err.ErrMalformedXML)
+	}
+
 	// S3 caps a single DeleteObjects request at 1000 keys. Reject an
 	// over-limit request before authorization and before anything reaches
 	// the backend, so a too-large batch can't be applied partially.

s3api/controllers/bucket-post_test.go

@@ -241,13 +241,17 @@ func TestS3ApiController_DeleteObjects(t *testing.T) {
 			},
 			output: testOutput{
 				response: &Response{
-					Data: s3response.DeleteResult{},
 					MetaOpts: &MetaOptions{
 						BucketOwner: "root",
-						EventName:   s3event.EventObjectRemovedDeleteObjects,
-						ObjectCount: 0,
 					},
 				},
+				err: s3err.GetAPIError(s3err.ErrMalformedXML),
+			},
+			configureMock: func(be *BackendMock) {
+				be.DeleteObjectsFunc = func(contextMoqParam context.Context, deleteObjectsInput *s3.DeleteObjectsInput) (s3response.DeleteResult, error) {
+					t.Error("backend DeleteObjects called for an empty delete list")
+					return s3response.DeleteResult{}, nil
+				}
 			},
 		},
 		{