Summary

Two security fixes for the Admin API SSL resource handler.

Fix 1: Admin API SSL GET single response exposes keys array

GET /apisix/admin/ssls/{id} cleared the key field (single-cert private key) but left the keys array (multi-cert private keys) intact, so callers retrieving a multi-cert SSL object received all additional private keys in plain text.

Root cause: The sanitization block only set value.key = nil and did not touch value.keys.

Fix: Set value.keys = nil alongside value.key = nil in the single-resource GET path.

Fix 2: Admin API SSL list response does not sanitize private keys at all

GET /apisix/admin/ssls (range / list query) returned every item's key and keys fields without any sanitization.

Root cause: The sanitization logic only ran on res.body.node.value (single-item path); the list path (res.body.list) was never covered.

Fix: After the single-item sanitization block, add a loop over res.body.list that strips both key and keys from every item's value.

Changes

• apisix/admin/resource.lua: strip keys = nil in single GET; add list sanitization loop for both key and keys
• t/admin/ssl.t: TEST 24 verifies keys is absent in single GET; TEST 25 verifies both fields absent in list GET; TEST 26 cleans up

Tests

• TEST 24: PUT a multi-cert SSL object, GET it by ID, assert neither key nor keys appears in the response body.
• TEST 25: GET the SSL list, iterate every item, assert neither key nor keys is present.
• TEST 26: DELETE the SSL object created in TEST 24.