shreemaan-abhishek commented on PR #2807:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2807#issuecomment-5078488884
Closing: the reviewer is right, and I reproduced it.
The Kubernetes apiserver collapses duplicate JSON object keys (last-wins)
while decoding the request, before admission webhooks run and before storage.
`config` is `x-kubernetes-preserve-unknown-fields` (an object), so it is still
fully parsed and re-serialized. POSTing the PoC through the raw endpoint
confirms the duplicate never survives:
```
$ kubectl create --raw
'/apis/apisix.apache.org/v1alpha1/namespaces/default/consumers' -f - <<'JSON'
{"apiVersion":"apisix.apache.org/v1alpha1","kind":"Consumer","metadata":{"name":"poc","namespace":"default"},
"spec":{"gatewayRef":{"name":"test-gateway"},
"credentials":[{"type":"key-auth","name":"c1","config":{"key":123,"key":"victims-key"}}]}}
JSON
Warning: duplicate field "spec.credentials[0].config.key"
# stored + admitted object:
"credentials":[{"config":{"key":"victims-key"},"name":"c1","type":"key-auth"}]
```
So the webhook's `Config.Raw` is the normalized `{"key":"victims-key"}` -
the original struct decoder parses it fine and the duplicate check runs;
webhook and cjson never disagree. The PoC only fired because it fed
hand-written `Raw` bytes directly to `ValidateCreate`, which the apiserver
cannot produce.
The second review comment is also correct: the change regressed the
existing-consumers loop from a per-credential skip into a gateway-wide denial
when a single stored Consumer has a non-string key config. Both reasons to drop
this. The underlying finding is not exploitable via the admission path. Thanks
for the thorough review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
