Summary

Fix multiple TLS and credential-encryption vulnerabilities across several plugins, and a bug in the shared check_https utility.

wolf-rbac: ssl_verify hardcoded to false

http_req() passed ssl_verify = false unconditionally to resty.http, so TLS certificate verification was always disabled regardless of the server endpoint. There was also no schema field to let users enable it.

Additionally, request_to_wolf_server() logged the full response body at both info and error level — core.log.info("request [...] success! response body:", core.json.delay_encode(body)) — which could leak wolf tokens and user PII into the error log.

Fix: Add ssl_verify boolean field to the consumer schema (nil by default). Thread it through http_req(), http_get(), check_url_permission(), and request_to_wolf_server(). Remove full response body from log statements; retain only body.reason on error.

ai-rag: Azure HTTPS calls without certificate verification

Both azure_openai.get_embeddings() and azure_ai_search.search() called httpc:request_uri(endpoint, { ..., body = body_tab }) with no ssl_verify field, so resty.http performed no certificate verification for the Azure HTTPS endpoints.

Fix: Add ssl_verify boolean field (default true) to the plugin schema. Pass it to both driver request_uri() calls. Add check_https warnings for embeddings_provider.azure_openai.endpoint and vector_search_provider.azure_ai_search.endpoint.

aws-lambda: IAM credentials stored as plaintext in etcd

The plugin had no encrypt_fields declaration, so authorization.apikey, authorization.iam.accesskey, and authorization.iam.secretkey were stored as plaintext strings in etcd — e.g. "secretkey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY".

Fix: Add plugin.schema.encrypt_fields covering all three credential paths.

core/utils: check_https exits loop early on first missing field

check_https used return when a field was nil or get_root_conf returned nothing, which exited the entire loop instead of moving to the next field. For example:

core.utils.check_https({
    "embeddings_provider.azure_openai.endpoint",    -- if this is absent ...
    "vector_search_provider.azure_ai_search.endpoint",  -- ... this is never checked
}, conf, plugin_name)

get_root_conf also had no guard when an intermediate path segment was not a table, which could cause a nil-index panic.

Fix: Replace return with goto continue so all fields are always checked. Add a type(conf) ~= "table" guard in get_root_conf to return nil, nil safely.

Changes

• apisix/core/utils.lua — get_root_conf: return nil, nil if intermediate path is not a table; check_https: goto continue instead of return
• apisix/plugins/wolf-rbac.lua — add ssl_verify field; thread through all HTTP call sites; remove response body from logs
• apisix/plugins/ai-rag.lua — add ssl_verify field (default true); add check_https and check_tls_bool in check_schema; pass ssl_verify to both driver calls
• apisix/plugins/ai-rag/embeddings/azure_openai.lua — accept and pass ssl_verify to request_uri
• apisix/plugins/ai-rag/vector-search/azure_ai_search.lua — accept and pass ssl_verify to request_uri
• apisix/plugins/aws-lambda.lua — add encrypt_fields for authorization.apikey, authorization.iam.accesskey, authorization.iam.secretkey

Tests

• t/plugin/wolf-rbac.t — TEST 38/39: monkey-patch resty.http to intercept request_uri opts and assert ssl_verify is forwarded correctly for both false and true; TEST 40: schema rejects non-boolean value
• t/plugin/ai-rag.t — TEST 15/16: ssl_verify defaults to true and can be set to false; TEST 17: monkey-patch resty.http to assert ssl_verify = false reaches both the embeddings and vector-search request_uri calls
• t/plugin/aws-lambda.t — TEST 7: cleanup route; TEST 8: write credentials via admin API, read directly from etcd, assert all three fields are stored as ciphertext while admin API returns plaintext