(apisix) branch master updated: fix(csrf): safely validate decoded token table and fields (#14025)

[guoqi.apache.org via notifications]

This is an automated email from the ASF dual-hosted git repository.

guoqqqi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git


The following commit(s) were added to refs/heads/master by this push:
     new 37b6304808 fix(csrf): safely validate decoded token table and fields 
(#14025)
37b6304808 is described below

commit 37b6304808588143ef33085e7f832f2776526b87
Author: Bhuvan Somisetty <somisettybhuv...@gmail.com>
AuthorDate: Wed Nov 4 22:07:33 2026 +0530

    fix(csrf): safely validate decoded token table and fields (#14025)
---
 apisix/plugins/csrf.lua | 12 ++++---
 t/plugin/csrf.t         | 88 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 5 deletions(-)

diff --git a/apisix/plugins/csrf.lua b/apisix/plugins/csrf.lua
index 4ed2ad624a..88af4fa2d4 100644
--- a/apisix/plugins/csrf.lua
+++ b/apisix/plugins/csrf.lua
@@ -23,6 +23,8 @@ local ngx_decode_base64 = ngx.decode_base64
 local ngx_time = ngx.time
 local ngx_cookie_time = ngx.cookie_time
 local math = math
+local type = type
+local tonumber = tonumber
 local SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
 
 
@@ -98,18 +100,18 @@ local function check_csrf_token(conf, ctx, token)
     end
 
     local token_table, err = core.json.decode(token_str)
-    if err then
-        core.log.error("decode token error: ", err)
+    if err or type(token_table) ~= "table" then
+        core.log.error("decode token error: ", err or "token is not an object")
         return false
     end
 
     local random = token_table["random"]
-    if not random then
+    if not random or (type(random) ~= "number" and type(random) ~= "string") 
then
         core.log.error("no random in token")
         return false
     end
 
-    local expires = token_table["expires"]
+    local expires = tonumber(token_table["expires"])
     if not expires then
         core.log.error("no expires in token")
         return false
@@ -121,7 +123,7 @@ local function check_csrf_token(conf, ctx, token)
     end
 
     local sign = gen_sign(random, expires, conf.key)
-    if token_table["sign"] ~= sign then
+    if type(token_table["sign"]) ~= "string" or token_table["sign"] ~= sign 
then
         core.log.error("Invalid signatures")
         return false
     end
diff --git a/t/plugin/csrf.t b/t/plugin/csrf.t
index 6ed8b95925..f40c60a80a 100644
--- a/t/plugin/csrf.t
+++ b/t/plugin/csrf.t
@@ -388,3 +388,91 @@ apisix:
 --- response_body
 userkey
 mt39FazQccyMqt4ctoRV7w==
+
+
+
+=== TEST 16: non-table csrf token (JSON number)
+--- request
+POST /hello
+--- more_headers
+apisix-csrf-token: MTIz
+Cookie: apisix-csrf-token=MTIz
+--- error_code: 401
+--- error_log: decode token error
+--- no_error_log
+attempt to index
+--- response_body
+{"error_msg":"Failed to verify the csrf token signature"}
+
+
+
+=== TEST 17: non-table csrf token (JSON boolean)
+--- request
+POST /hello
+--- more_headers
+apisix-csrf-token: dHJ1ZQ==
+Cookie: apisix-csrf-token=dHJ1ZQ==
+--- error_code: 401
+--- error_log: decode token error
+--- no_error_log
+attempt to index
+--- response_body
+{"error_msg":"Failed to verify the csrf token signature"}
+
+
+
+=== TEST 18: csrf token with invalid non-numeric expires
+--- request
+POST /hello
+--- more_headers
+apisix-csrf-token: 
eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6ImludmFsaWQiLCJzaWduIjoiYWJjIn0=
+Cookie: 
apisix-csrf-token=eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6ImludmFsaWQiLCJzaWduIjoiYWJjIn0=
+--- error_code: 401
+--- error_log: no expires in token
+--- no_error_log
+attempt to perform arithmetic
+--- response_body
+{"error_msg":"Failed to verify the csrf token signature"}
+
+
+
+=== TEST 19: non-table csrf token (JSON null)
+--- request
+POST /hello
+--- more_headers
+apisix-csrf-token: bnVsbA==
+Cookie: apisix-csrf-token=bnVsbA==
+--- error_code: 401
+--- error_log: decode token error
+--- no_error_log
+attempt to index
+--- response_body
+{"error_msg":"Failed to verify the csrf token signature"}
+
+
+
+=== TEST 20: csrf token with invalid random type
+--- request
+POST /hello
+--- more_headers
+apisix-csrf-token: 
eyJyYW5kb20iOnRydWUsImV4cGlyZXMiOjk5OTk5OTk5OTksInNpZ24iOiJhYmMifQ==
+Cookie: 
apisix-csrf-token=eyJyYW5kb20iOnRydWUsImV4cGlyZXMiOjk5OTk5OTk5OTksInNpZ24iOiJhYmMifQ==
+--- error_code: 401
+--- error_log: no random in token
+--- no_error_log
+attempt to concatenate
+--- response_body
+{"error_msg":"Failed to verify the csrf token signature"}
+
+
+
+=== TEST 21: csrf token with invalid sign type
+--- request
+POST /hello
+--- more_headers
+apisix-csrf-token: 
eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6OTk5OTk5OTk5OSwic2lnbiI6MTIzfQ==
+Cookie: 
apisix-csrf-token=eyJyYW5kb20iOjAuMSwiZXhwaXJlcyI6OTk5OTk5OTk5OSwic2lnbiI6MTIzfQ==
+--- error_code: 401
+--- error_log: Invalid signatures
+--- response_body
+{"error_msg":"Failed to verify the csrf token signature"}