bhuvan-somisetty opened a new pull request, #14165:
URL: https://github.com/apache/apisix/pull/14165
### Description
In `apisix/plugins/body-transformer.lua`, when `input_format` is `"json"`
(or inferred from `Content-Type: application/json`), the decoder used
`core.json.decode(data)` without checking if the decoded result is a table.
When the body is a valid JSON primitive (such as a number `123`, a string
`"hello"`, a boolean `true`/`false`, or `null`), `core.json.decode` returns a
Lua primitive value (`number`, `string`, `boolean`, or `cjson.null` userdata).
Attempting to index helper fields on `out` (e.g. `out._ctx = nil`) and passing
it to `setmetatable(out, ...)` causes a fatal runtime error:
```text
attempt to index local 'out' (a number value)
```
and aborts the request with HTTP 500 Internal Server Error.
This patch updates the `json` decoder to verify that the decoded value is a
table (object or array). If a JSON primitive is received, it returns an error
so that `transform()` rejects the request cleanly with HTTP 400 Bad Request
(`{"message": "request body decode: expected JSON object or array"}`).
#### Which issue(s) this PR fixes:
Fixes #14164
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
