membphis commented on PR #13884: URL: https://github.com/apache/apisix/pull/13884#issuecomment-5435394739
[P1] Reject passwords that resolve to an empty secret or environment value minLength = 1 only validates the non-empty $secret://... or $env://... reference string. consumer.lua resolves that reference before building the consumer cache, and a resolved empty string is not rejected. basic-auth.lua then compares it directly with the request password, so a Basic header containing the matching username and an empty password can still authenticate when the reference resolves to "". Please reject an empty password after secret/environment resolution, for example in the basic-auth runtime check or by revalidating the resolved consumer config, and add regressions showing $env:// and $secret:// values resolving to "" return the generic 401 response. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
