shreemaan-abhishek opened a new pull request, #13691:
URL: https://github.com/apache/apisix/pull/13691
### Description
The `request-validation` plugin decides whether a request body is
form-urlencoded by lowercasing the `Content-Type` header and prefix-matching it:
```lua
if headers["content-type"]
and core.string.has_prefix(headers["content-type"]:lower(),
"application/x-www-form-urlencoded")
then
```
`headers` comes from `ngx.req.get_headers()`, which returns a **table** (not
a string) when a header appears more than once. So a request that carries a
duplicated `Content-Type` header makes `headers["content-type"]` a table, and
`table:lower()` raises `attempt to call method 'lower' (a nil value)` in the
`rewrite` phase. The request then fails with a 500 and an error log, instead of
being validated (or cleanly rejected).
This PR guards the value with a string type check before calling `:lower()`.
A non-string `Content-Type` now falls through to the JSON default path,
matching the plugin's intent for anything that is not form-urlencoded.
While here, the existing charset test used an all-lowercase media type, so
it never actually exercised the `:lower()` call; it now uses a mixed-case media
type. A new test covers the duplicated-header path.
#### Which issue(s) this PR fixes:
Fixes #
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
<!-- Docs unchanged: this is an internal robustness fix; the documented
schema-validation behavior is unchanged. -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
