You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by sp...@apache.org on 2021/11/10 07:48:24 UTC
[apisix] branch master updated: fix(hmac-auth): check if the
X-HMAC-ALGORITHM header is missing (#5467)
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 1514fe4 fix(hmac-auth): check if the X-HMAC-ALGORITHM header is missing (#5467)
1514fe4 is described below
commit 1514fe48c349534a88fda669ac2ecda8ee31f27c
Author: tzssangglass <tz...@gmail.com>
AuthorDate: Wed Nov 10 01:48:05 2021 -0600
fix(hmac-auth): check if the X-HMAC-ALGORITHM header is missing (#5467)
---
apisix/plugins/hmac-auth.lua | 4 ++++
t/plugin/hmac-auth.t | 49 +++++++++++++++++++++++++++++---------------
2 files changed, 36 insertions(+), 17 deletions(-)
diff --git a/apisix/plugins/hmac-auth.lua b/apisix/plugins/hmac-auth.lua
index 35a11bd..73cb947 100644
--- a/apisix/plugins/hmac-auth.lua
+++ b/apisix/plugins/hmac-auth.lua
@@ -291,6 +291,10 @@ local function validate(ctx, params)
return nil, {message = "access key or signature missing"}
end
+ if not params.algorithm then
+ return nil, {message = "algorithm missing"}
+ end
+
local consumer, err = get_consumer(params.access_key)
if err then
return nil, err
diff --git a/t/plugin/hmac-auth.t b/t/plugin/hmac-auth.t
index cc029db..4de139b 100644
--- a/t/plugin/hmac-auth.t
+++ b/t/plugin/hmac-auth.t
@@ -241,7 +241,22 @@ GET /hello
-=== TEST 8: verify: invalid access key
+=== TEST 8: verify, missing algorithm
+--- request
+GET /hello
+--- more_headers
+X-HMAC-SIGNATURE: asdf
+Date: Thu, 24 Sep 2020 06:39:52 GMT
+X-HMAC-ACCESS-KEY: my-access-key
+--- error_code: 401
+--- response_body
+{"message":"algorithm missing"}
+--- no_error_log
+[error]
+
+
+
+=== TEST 9: verify: invalid access key
--- request
GET /hello
--- more_headers
@@ -257,7 +272,7 @@ X-HMAC-ACCESS-KEY: sdf
-=== TEST 9: verify: invalid algorithm
+=== TEST 10: verify: invalid algorithm
--- request
GET /hello
--- more_headers
@@ -273,7 +288,7 @@ X-HMAC-ACCESS-KEY: my-access-key
-=== TEST 10: verify: Clock skew exceeded
+=== TEST 11: verify: Clock skew exceeded
--- request
GET /hello
--- more_headers
@@ -289,7 +304,7 @@ X-HMAC-ACCESS-KEY: my-access-key
-=== TEST 11: verify: missing Date
+=== TEST 12: verify: missing Date
--- request
GET /hello
--- more_headers
@@ -304,7 +319,7 @@ X-HMAC-ACCESS-KEY: my-access-key
-=== TEST 12: verify: Invalid GMT format time
+=== TEST 13: verify: Invalid GMT format time
--- request
GET /hello
--- more_headers
@@ -320,7 +335,7 @@ X-HMAC-ACCESS-KEY: my-access-key
-=== TEST 13: verify: ok
+=== TEST 14: verify: ok
--- config
location /t {
content_by_lua_block {
@@ -381,7 +396,7 @@ passed
-=== TEST 14: add consumer with 0 clock skew
+=== TEST 15: add consumer with 0 clock skew
--- config
location /t {
content_by_lua_block {
@@ -429,7 +444,7 @@ passed
-=== TEST 15: verify: invalid signature
+=== TEST 16: verify: invalid signature
--- request
GET /hello
--- more_headers
@@ -445,7 +460,7 @@ X-HMAC-ACCESS-KEY: my-access-key3
-=== TEST 16: add consumer with 1 clock skew
+=== TEST 17: add consumer with 1 clock skew
--- config
location /t {
content_by_lua_block {
@@ -493,7 +508,7 @@ passed
-=== TEST 17: verify: Invalid GMT format time
+=== TEST 18: verify: Invalid GMT format time
--- config
location /t {
content_by_lua_block {
@@ -548,7 +563,7 @@ qr/\{"message":"Clock skew exceeded"\}/
-=== TEST 18: verify: put ok
+=== TEST 19: verify: put ok
--- config
location /t {
content_by_lua_block {
@@ -613,7 +628,7 @@ passed
-=== TEST 19: verify: put ok (pass auth data by header `Authorization`)
+=== TEST 20: verify: put ok (pass auth data by header `Authorization`)
--- config
location /t {
content_by_lua_block {
@@ -677,7 +692,7 @@ passed
-=== TEST 20: hit route without auth info
+=== TEST 21: hit route without auth info
--- request
GET /hello
--- error_code: 401
@@ -688,7 +703,7 @@ GET /hello
-=== TEST 21: add consumer with signed_headers
+=== TEST 22: add consumer with signed_headers
--- config
location /t {
content_by_lua_block {
@@ -737,7 +752,7 @@ passed
-=== TEST 22: verify with invalid signed header
+=== TEST 23: verify with invalid signed header
--- config
location /t {
content_by_lua_block {
@@ -790,7 +805,7 @@ qr/\{"message":"Invalid signed header x-custom-header-c"\}/
-=== TEST 23: verify ok with signed headers
+=== TEST 24: verify ok with signed headers
--- config
location /t {
content_by_lua_block {
@@ -847,7 +862,7 @@ passed
-=== TEST 24: add consumer with plugin hmac-auth - empty configuration
+=== TEST 25: add consumer with plugin hmac-auth - empty configuration
--- config
location /t {
content_by_lua_block {