From ebfc98df589869b835991cb95ff8ac3ddfc6b6ee Mon Sep 17 00:00:00 2001
From: Jon Ayers <jon@coder.com>
Date: Thu, 28 Aug 2025 09:33:51 -0700
Subject: [PATCH] chore: move guards to satisfy CodeQL (#19600)

---
 site/site.go | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/site/site.go b/site/site.go
index d15439b264..b91bde14cc 100644
--- a/site/site.go
+++ b/site/site.go
@@ -1018,16 +1018,6 @@ func newBinMetadataCache(binFS http.FileSystem, binSha1Hashes map[string]string)
 }
 
 func (b *binMetadataCache) getMetadata(name string) (binMetadata, error) {
-	// Reject any invalid or non-basename paths before touching the filesystem.
-	if name == "" ||
-		name == "." ||
-		strings.Contains(name, "/") ||
-		strings.Contains(name, "\\") ||
-		!fs.ValidPath(name) ||
-		path.Base(name) != name {
-		return binMetadata{}, os.ErrNotExist
-	}
-
 	b.mut.RLock()
 	metadata, ok := b.metadata[name]
 	b.mut.RUnlock()
@@ -1040,6 +1030,16 @@ func (b *binMetadataCache) getMetadata(name string) (binMetadata, error) {
 		b.sem <- struct{}{}
 		defer func() { <-b.sem }()
 
+		// Reject any invalid or non-basename paths before touching the filesystem.
+		if name == "" ||
+			name == "." ||
+			strings.Contains(name, "/") ||
+			strings.Contains(name, "\\") ||
+			!fs.ValidPath(name) ||
+			path.Base(name) != name {
+			return binMetadata{}, os.ErrNotExist
+		}
+
 		f, err := b.binFS.Open(name)
 		if err != nil {
 			return binMetadata{}, err