fix(jwt-auth): real_payload was overridden by malicious payload

apisix/plugins/jwt-auth.lua

@@ -254,7 +254,8 @@ local function get_real_payload(key, auth_conf, payload)
     }
     if payload then
         local extra_payload = core.json.decode(payload)
-        core.table.merge(real_payload, extra_payload)
+        core.table.merge(extra_payload, real_payload)
+        return extra_payload
     end
     return real_payload
 end

t/plugin/jwt-auth4.t

@@ -0,0 +1,67 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+BEGIN {
+    $ENV{VAULT_TOKEN} = "root";
+}
+
+use t::APISIX 'no_plan';
+
+repeat_each(1);
+no_long_string();
+no_root_location();
+no_shuffle();
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    if ((!defined $block->error_log) && (!defined $block->no_error_log)) {
+        $block->set_value("no_error_log", "[error]");
+    }
+
+    if (!defined $block->request) {
+        $block->set_value("request", "GET /t");
+        if (!$block->response_body) {
+            $block->set_value("response_body", "passed\n");
+        }
+    }
+});
+
+run_tests;
+
+__DATA__
+
+=== TEST 24: verify the real_payload's value (key & exp) is not overridden by malicious payload
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.jwt-auth")
+            local auth_conf = {exp = 7200}
+            local bad_payload = {key="letmein", exp = 120}
+
+            local final_payload, err = plugin.get_real_payload("prod", auth_conf, bad_payload)
+
+            if not final_payload then
+                ngx.say(err)
+            end
+
+            if final_payload.key == "prod" and final_payload.exp ~= 120 then
+                ngx.say("safe")
+            end
+        }
+    }
+--- response_body
+safe