apache / openwhisk-apigateway

Apache OpenWhisk API Gateway service for exposing actions as REST interfaces.
https://openwhisk.apache.org/
Apache License 2.0
64 stars 45 forks source link

Variable scope leakage causing auth failures / race conditions #378

Open mhamann opened 3 years ago

mhamann commented 3 years ago

When running a gateway using Openresty 1.15.8.3, the https://github.com/apache/openwhisk-apigateway/blob/master/scripts/lua/policies/security/apiKey.lua and https://github.com/apache/openwhisk-apigateway/blob/master/scripts/lua/policies/security/clientSecret.lua files are conflicting due to having functions of the same name, but not defined as local.

I currently don't know why this wasn't an issue on 1.13.x, but those builds do not exhibit this behavior.

The module functions need to be declared local in order to prevent the scope issues.