fix(security): TLS ssl_verify hardcoding and credential encryption issues#13203
Open
AlinsRan wants to merge 1 commit intoapache:masterfrom
Open
fix(security): TLS ssl_verify hardcoding and credential encryption issues#13203AlinsRan wants to merge 1 commit intoapache:masterfrom
AlinsRan wants to merge 1 commit intoapache:masterfrom
Conversation
dosubot
bot
added
size:L
AlinsRan
force-pushed
the
fix/tls-ssl-verify-credential-encryption
branch
from
2fdfcc4 to
e74a195
Compare
…sues - wolf-rbac: add configurable ssl_verify field (default nil/false) to plugin schema; thread through http_req/http_get/check_url_permission/ request_to_wolf_server; fix check_schema to run schema validation before check_https; add check_tls_bool call - ai-rag: add ssl_verify field (default true) to plugin schema; pass ssl_verify to embeddings and vector-search driver request_uri calls; also remove stray 'type = object' line from properties table - ai-rag/embeddings/azure_openai: accept ssl_verify param and pass to request_uri - ai-rag/vector-search/azure_ai_search: accept ssl_verify param and pass to request_uri - aws-lambda: add encrypt_fields for authorization.apikey, authorization.iam.accesskey, and authorization.iam.secretkey so credentials are stored encrypted at rest in etcd
AlinsRan
force-pushed
the
fix/tls-ssl-verify-credential-encryption
branch
from
e74a195 to
633ffc6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes multiple TLS and encryption security vulnerabilities across several plugins.
Issues Fixed
wolf-rbac: hardcoded
ssl_verify=falsessl_verify = false, disabling certificate verification even for HTTPS endpoints.ssl_verifyfield to plugin schema (no default — users opt in). Threaded throughhttp_req(),http_get(),check_url_permission(), andrequest_to_wolf_server(). Also fixedcheck_schemato runcore.schema.checkbeforecheck_https, and addedcheck_tls_boolcall.ai-rag plugin: no TLS certificate verification for Azure calls
ai-ragplugin called Azure OpenAI Embeddings and Azure AI Search viaresty.httpwithout settingssl_verify, meaning no certificate verification was performed. Also removed a straytype = "object"line from the schemapropertiestable.ssl_verifyfield to the top-levelai-ragschema (defaulttrue). Passed to both embedding and vector-search driverrequest_uri()calls.aws-lambda: IAM credentials not encrypted at rest
authorization.apikeyandauthorization.iam.secretkey/accesskeyfields but had noencrypt_fieldsdeclaration. These credentials were stored in plaintext in etcd.encrypt_fields = {"authorization.apikey", "authorization.iam.accesskey", "authorization.iam.secretkey"}to the plugin schema.Files Changed
apisix/plugins/wolf-rbac.luaapisix/plugins/ai-rag.luaapisix/plugins/ai-rag/embeddings/azure_openai.luaapisix/plugins/ai-rag/vector-search/azure_ai_search.luaapisix/plugins/aws-lambda.luat/plugin/wolf-rbac.t— TEST 38-40: ssl_verify schema validationt/plugin/ai-rag.t— TEST 13-14: ssl_verify defaults to true, can be set falset/plugin/aws-lambda.t— TEST 7: encrypt_fields covers all credential fields