AlinsRan opened a new pull request, #13680:
URL: https://github.com/apache/apisix/pull/13680
### Description
Fixes #13440
The shared cjson instance in \`lua-resty-session\`
(\`lib/resty/session/utils.lua\`) decodes JSON without the array metatable. An
empty array therefore loses its array identity across the session save/load
cycle and is re-encoded as an object.
With \`openid-connect\`, userinfo is stored in the session and read back on
subsequent requests, so an empty claim such as \`roles\` comes back as a plain
empty table and \`core.json.encode\` renders it as an object:
```
IdP userinfo : {"sub":"a UID","name":"Testuser One","roles":[]}
X-Userinfo : {"sub":"a UID","name":"Testuser One","roles":{}} <- roles
became an object
```
Note the corruption is *not* in `openid-connect` or in openidc's own decode:
`core/json.lua` enables `decode_array_with_array_mt(true)` on the shared
`cjson.safe` singleton, which openidc reuses, so the array survives into the
session. It is lost on the way out, in `lua-resty-session`'s own
`cjson.safe.new()` instance, which does not have that option set.
### Fix
Switch the dependency to `api7-lua-resty-session = 4.1.6-0`, which enables
`decode_array_with_array_mt` on that instance (upstream PR:
bungle/lua-resty-session#207).
`lua-resty-openidc` (`>= 4.0.3`) and `lua-resty-saml` (`= 4.1.5-1`) still
declare the upstream `lua-resty-session`, so it is still installed
transitively. That is fine: LuaRocks gives the canonical module path to the
lexicographically smaller rock name (`luarocks/repos.lua`, `name < cur_name`),
so `api7-lua-resty-session` owns `resty.session.*` and the upstream copy is
relegated to a versioned directory that nothing requires. This is exactly the
arrangement already used by `api7-lua-resty-http` and `api7-lua-resty-jwt`,
which coexist with the upstream rocks pulled in by openidc.
### Verification
Resolving the dependency set (`api7-lua-resty-session` + `lua-resty-openidc`
+ `lua-resty-saml`) into a clean tree:
```
installed : api7-lua-resty-session, lua-resty-openidc, lua-resty-saml,
lua-resty-session
canonical : share/lua/5.1/resty/session/utils.lua -> has
decode_array_with_array_mt
relegated : share/lua/5.1/lua_resty_session_4_1_5_1-resty/ (upstream,
unreferenced)
```
Replaying the userinfo round-trip through that tree:
```
require resty.openidc : ok
session stored : {"roles":[],"sub":"a UID","name":"Testuser One"}
X-Userinfo : {"roles":[],"sub":"a UID","name":"Testuser One"}
```
The result is independent of install order, since the winner is decided by
rock name rather than by installation sequence.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
