nic-6443 opened a new pull request, #13831: URL: https://github.com/apache/apisix/pull/13831
### Description The memory strategy of `proxy-cache` lays its shdict keys out as `<cache key>` for the plain entry, `<cache key>::__vary` for the variant index and `<cache key>::<signature>` for each variant, where the signature is `md5()` over the request's values for the varied headers. The cache key is client controlled — `cache_key` defaults to `$host` and `$request_uri` — and the signature is offline computable, so a request to `/<victim uri>::<md5 of the varied values>` gets a cache key byte-identical to the victim's variant key. Nothing on the entry records which key it belongs to, so: - the crafted request is served the victim's cached variant (cross-request cache read), and - its own response is stored there, where the victim's next request looks the variant up (cache poisoning). Same trick works against the `::__vary` index key. The fix keeps the derivation injective by prefixing the cache key with its length before appending anything: for two different cache keys either the length field or the key itself differs, so no crafted cache key can produce another one's storage key. Entries cached before the upgrade become unreachable and expire on their own TTL — the first request per key after the upgrade is a MISS. `t/plugin/proxy-cache/memory.t` TEST 48 caches a `Vary: Accept-Encoding` response, then sends the crafted URI: on master the crafted request answers `HIT` with the victim's body, with this change it is a plain `MISS` with its own body and the victim's entry stays intact. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change — internal key layout, no documented behaviour changes - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
