Baoyuantop commented on issue #13237:
URL: https://github.com/apache/apisix/issues/13237#issuecomment-4293176841
Hi @Goend, The solution in PR #13243 (which only bypasses the issue in
`ext-plugin-post-resp`) is merely a stopgap measure, for the following reasons:
- Over 20 other plugins that call `core.request.get_body()` still have
the same issue
- It bypasses security mechanisms such as the `max_size` check in
`core.request.get_body()`
Recommended solution: Fix the validation logic in the `get_body()` function
in `core/request.lua`:
```
-- check content-length header for http2/http3
do
local var = ctx and ctx.var or ngx.var
local content_length = tonumber(var.http_content_length)
if (var.server_protocol == "HTTP/2.0" or var.server_protocol ==
"HTTP/3.0")
and not content_length then
-- No Content-Length in H2/H3: treat as no body (not an error)
return nil
end
end
```
Change `return nil, err` to `return nil` (no body, no error), so that:
- All plugins that call `get_body()` automatically benefit
- For POST/PUT requests that actually require a body, the caller will check
if the return value is `nil` and handle it as needed
- The integrity of safety checks such as `max_size` is preserved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
