shreemaan-abhishek opened a new pull request, #2807:
URL: https://github.com/apache/apisix-ingress-controller/pull/2807
## What this PR does
The `Consumer` validating webhook extracts the key-auth `key` from inline
credential config with Go's `encoding/json` struct decoder. Given a
duplicate-key object like `{"key":123,"key":"K"}`, that decoder returns a
type-mismatch error, so `extractCredentialKey` logs and **skips the duplicate
check entirely** (returns `"", nil`). Downstream `cjson` (last-wins, no type
abort) resolves the same raw bytes to a live key `"K"`.
Net effect: the webhook's only hard-deny credential check is evadable by any
Consumer creator who knows a colliding key. They submit an inline config the
webhook can't read but ADC/cjson can, and a duplicate active key-auth
credential lands, causing consumer-identity confusion downstream. Check-bypass
only (attacker must already know the key), calibrated Low.
## Fix
Parse inline key-auth config aligned with the downstream `cjson` semantics
(exact-case, string-valued, last-wins) via a token-level walk, and reject the
shapes that cause the divergence instead of silently skipping:
- **Duplicate `key` members** → hard admission error.
- **Non-string `key`** (number/bool/object/array) → hard admission error.
- Genuinely malformed JSON that `cjson` would also reject → still lenient
(`"", nil`), so existing consumers with broken config are not suddenly denied.
- Exact-case matching means `{"Key":"K"}` is ignored (matches cjson, which
only reads lowercase `key`), removing a false-positive divergence in the other
direction.
## Tests
- `TestConsumerValidator_DenyDuplicateKeyAuthCredential_ParserDivergence`
drives the `{"key":123,"key":"K"}` PoC end-to-end through `ValidateCreate` and
asserts admission is denied.
- `TestParseInlineKeyAuthKey` table-tests the parser: valid key, duplicate
members, number-then-string PoC, non-string, object value, null, missing key,
exact-case, malformed, non-object.
```
go test ./internal/webhook/v1/... # pass
go vet ./internal/webhook/... # clean
```
Fixes FINDING-015 (api7/rfcs#149).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
