ruanweihong-aaa opened a new pull request, #14074:
URL: https://github.com/apache/apisix/pull/14074
## Description
Standalone YAML expands environment variables before parsing. Raw multiline
PEM values can therefore cause YAML parse errors or have their newlines folded,
preventing SSL resources from loading.
This change preserves multiline values when a complete environment reference
is used in an SSL resource's `cert`, `key`, `certs`/`keys` array item, or
`client.ca`.
For example, `SERVER_CERT` and `SERVER_KEY` can contain original multiline
PEM:
```yaml
ssls:
- id: example
snis: ["example.com"]
cert: "${{SERVER_CERT}}"
key: "${{SERVER_KEY}}"
#END
```
The loader builds a temporary discovery copy, identifies supported fields,
and protects the corresponding variable occurrences with placeholders during
the final YAML parse. It checks scalar source locations and final field paths
before restoring the original values, preventing accidental replacement of user
content.
CLI validation and runtime file reload share the same helper. No new
dependency or configuration switch is introduced.
### Compatibility and supported scope
- Supports complete quoted or unquoted references in block-style and
flow-style YAML.
- Supports anchors and merges whose protected values are used only in
supported SSL fields.
- Preserves existing single-line substitution, YAML type inference, and
literal `\n` escape handling.
- Preserves existing folding and structure-expansion behavior for non-SSL
multiline fields.
- Reuses existing variable lookup, defaults, missing-variable errors, and
exported-variable tracking.
- Falls back to the existing loading behavior when discovery is ambiguous,
protected references are shared with non-SSL fields, or final checks fail.
These fallback cases do not receive the new multiline protection.
- Does not add protection for embedded references or references inside
literal/folded block scalars.
- Preserves legacy expansion when an entire configuration is supplied
through one variable; values introduced by another variable are not recursively
expanded.
JSON and bootstrap `config.yaml` processing are unchanged. `$ENV://` remains
an existing alternative. This change does not bypass SSL schema or certificate
validation.
### Related issue
Related to #14038.
### Validation
Tested using `apache/apisix:3.19.0-ubuntu` with the working-tree candidate
mounted:
- 24/24 focused regressions passed under plain LuaJIT.
- 24/24 focused regressions passed under OpenResty.
- Confirmed that stock CLI initialization rejects block-style unquoted
multiline PEM.
- Verified candidate startup with quoted PEM using the served certificate's
SHA-256 fingerprint.
- Verified that live YAML reload with unquoted flow references serves a
different certificate.
- Verified reload using the existing literal-backslash-n PEM format.
- Verified explicit candidate `apisix init`.
- Covered marker collisions, YAML escapes, structural substitution, shared
anchors, and cyclic aliases.
- Changed-file Lua lint passed with 0 warnings and 0 errors across four Lua
files.
- `git diff --check` and patch reverse-apply checks passed.
The full project test suite remains unverified. The release image lacks
`make` and the complete project test environment; full-suite validation
requires CI.
### Checklist
- [x] I have explained the need for this PR and the problem it solves.
- [x] I have explained the changes.
- [x] I have added tests corresponding to this change.
- [x] I have updated the documentation.
- [ ] I have verified that this change is backward compatible.
The compatibility checkbox remains open pending full CI validation and
maintainer review of the documented fallback behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
