shreemaan-abhishek opened a new pull request, #2809:
URL: https://github.com/apache/apisix-ingress-controller/pull/2809
### What this PR does
`translateConsumerHMACAuthPlugin` read `signed_headers` from a Secret by
ranging over its raw bytes:
```go
signedHeadersRaw := sec.Data["signed_headers"] // []byte
for _, b := range signedHeadersRaw { // ranges over bytes
signedHeaders = append(signedHeaders, string(b)) // one 1-char entry per
byte
}
```
Ranging over a `[]byte` yields `(index, byte)`, so `"X-Date,Host"` became
`["X","-","D","a","t","e",",","H","o","s","t"]`. The data-plane hmac-auth
policy then bound those single-character names into the signature, which never
match real headers, so the operator's intended headers were silently **not**
enforced as part of the HMAC signature. Only the `secretRef` path was affected;
the inline `Value` path already passes a `[]string`.
### Fix
- Split the `signed_headers` value on commas and trim entries.
- Surface `strconv.ParseInt` failures for `clock_skew` and `max_req_body`
instead of discarding them, so a typo no longer coerces silently to a default.
### Tests
- New unit tests: `signed_headers` from a Secret yields the correct header
list; an unparseable `clock_skew` is rejected.
Scope: `internal/adc/translator/apisixconsumer.go`, CRD-to-data-plane
fidelity. Self-scoped to the consumer owner's own config.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
