bhuvan-somisetty opened a new pull request, #14025: URL: https://github.com/apache/apisix/pull/14025
### Description In `apisix/plugins/csrf.lua`, `check_csrf_token` decodes the base64 token into JSON without verifying that the result is a table. When a client supplies a token decoding to a JSON primitive (e.g. number, boolean, null), indexing fields like `token_table["random"]` raises an unhandled Lua runtime error (e.g. `attempt to index a number value`), causing an HTTP 500 error instead of cleanly rejecting the request. This PR: - Verifies `type(token_table) == "table"` after JSON decoding. - Validates that `random`, `expires`, and `sign` are present with valid scalar types. - Adds comprehensive unit test cases in `t/plugin/csrf.t` verifying that non-table JSON tokens and invalid fields are rejected with HTTP 401 without crashing. #### Which issue(s) this PR fixes: Fixes #14024 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
