apache / apache/openwhisk-apigateway
Variable scope leakage causing auth failures / race conditions
Open
bug
- Dominant language
- Lua
- Stars
- 65
- Forks
- 43
- PR merge metrics
- No merged PRs in 30d
Description
When running a gateway using Openresty 1.15.8.3, the https://github.com/apache/openwhisk-apigateway/blob/master/scripts/lua/policies/security/apiKey.lua and https://github.com/apache/openwhisk-apigateway/blob/master/scripts/lua/policies/security/clientSecret.lua files are conflicting due to having functions of the same name, but not defined as `local`.
I currently don't know why this wasn't an issue on 1.13.x, but those builds do not exhibit this behavior.
The module functions need to be declared local in order to prevent the scope issues.
Contributor guide
Assessment
This issue has not been assessed yet.