fix(patch): make cjson instances inherit decode_array_with_array_mt

lua-cjson options are per-instance and cjson.new() starts from the
compile-time defaults, so enabling decode_array_with_array_mt on the
cjson.safe singleton in core/json.lua never reaches a dependency that
keeps a private instance. Those dependencies decode arrays without the
array metatable, and an empty array is re-encoded as an object.

Enable the option on both cjson singletons and wrap cjson.new /
cjson.safe.new so instances created afterwards inherit it. This replaces
the api7-lua-resty-session dependency swap: the fix now covers every
dependency with a private instance (lua-resty-healthcheck,
lua-resty-worker-events, lua-resty-aws, ...), not just lua-resty-session.

Author: AlinsRan

apisix-master-0.rockspec

@@ -46,7 +46,7 @@ dependencies = {
     "api7-lua-resty-jwt = 0.2.6-0",
     "lua-resty-hmac-ffi = 0.06-1",
     "lua-resty-cookie = 0.4.1-1",
-    "api7-lua-resty-session = 4.1.6-0",
+    "lua-resty-session = 4.1.5-1",
     "lua-resty-openapi-validator = 1.0.5-1",
     "opentracing-openresty = 0.1-0",
     "lua-resty-radixtree = 2.9.2-0",

apisix/patch.lua

@@ -364,7 +364,31 @@ local function luasocket_tcp()
 end
 
 
+-- lua-cjson options are per-instance, and cjson.new() always starts from the
+-- compile-time defaults instead of inheriting the singleton's configuration.
+-- core/json.lua only enables decode_array_with_array_mt on the `cjson.safe`
+-- singleton, so every dependency holding a private instance (lua-resty-session,
+-- lua-resty-healthcheck, lua-resty-worker-events, lua-resty-aws, ...) decodes
+-- arrays without the array metatable, and an empty array is then re-encoded as
+-- an object. Enable the option on both singletons and let every instance created
+-- afterwards inherit it. This only changes the default: a library explicitly
+-- calling decode_array_with_array_mt(false) on its own instance still wins.
+local function patch_cjson(cjson)
+    cjson.decode_array_with_array_mt(true)
+
+    local original_new = cjson.new
+    cjson.new = function (...)
+        local instance = original_new(...)
+        patch_cjson(instance)
+        return instance
+    end
+end
+
+
 function _M.patch()
+    patch_cjson(require("cjson"))
+    patch_cjson(require("cjson.safe"))
+
     -- make linter happy
     -- luacheck: ignore
     ngx_socket.tcp = function ()

t/core/json.t

@@ -193,3 +193,27 @@ b.d: 1
 e: text
 a or default: default
 top-level null: nil
+
+
+
+=== TEST 9: cjson instances created by dependencies keep empty arrays as arrays
+--- config
+    location /t {
+        content_by_lua_block {
+            -- a dependency that keeps a private instance, e.g. lua-resty-session
+            local safe_instance = require("cjson.safe").new()
+            ngx.say("cjson.safe instance: ",
+                    safe_instance.encode(safe_instance.decode('{"arr":[]}')))
+
+            local instance = require("cjson").new()
+            ngx.say("cjson instance: ", instance.encode(instance.decode('{"arr":[]}')))
+
+            -- the plain singleton is a separate config from cjson.safe
+            local cjson = require("cjson")
+            ngx.say("cjson singleton: ", cjson.encode(cjson.decode('{"arr":[]}')))
+        }
+    }
+--- response_body
+cjson.safe instance: {"arr":[]}
+cjson instance: {"arr":[]}
+cjson singleton: {"arr":[]}