sunnysabor opened a new pull request, #7633: URL: https://github.com/apache/shenyu/pull/7633
Fixes #6475. Malformed version-two authorization tokens now produce invalid sign parameters instead of escaping as unchecked exceptions. Validate the two token segments, decode as UTF-8, handle invalid Base64/null or non-object JSON/wrong field types, and reject nonnumeric or overflowing timestamps through the existing SIGN_PARAMS_ERROR verification response. Tests exercise malformed tokens and JSON, both body and no-body plugin paths with the real verification service, and invalid timestamps. They assert rejection without calling the downstream chain. The original implementation fails these regressions with parsing exceptions or invalid extraction results; valid signature coverage still passes. Validation: - ./mvnw -B -ntp -pl shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign -am -Djacoco.skip=true test apache-rat:check passed: 74 Sign module tests plus dependency tests; RAT 0 unapproved. - Full 209-module ./mvnw -B -ntp checkstyle:check passed. - git diff --check passed. Full repository clean install and Docker E2E were not run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
