fix(response-rewrite): do not empty body when base64 secret is invalid#13586
Open
AlinsRan wants to merge 1 commit into
Open
fix(response-rewrite): do not empty body when base64 secret is invalid#13586AlinsRan wants to merge 1 commit into
AlinsRan wants to merge 1 commit into
Conversation
When body is a secret reference and body_base64 is true, the config-time base64 validation is skipped because the value is unknown until runtime. If the resolved secret is not valid base64, ngx.decode_base64 returned nil and the response body was silently emptied. Log an error and leave the upstream response body unchanged instead. Add a test using an $env:// reference resolving to a non-base64 value. Signed-off-by: AlinsRan <alinsran@apache.org>
dosubot
Bot
added
size:M
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
With
body_base64 = trueandbodyset to a secret reference ($env://...,$secret://...), the config-time base64 validation is skipped because the value is unknown until runtime. If the resolved secret is not valid base64,ngx.decode_base64returnedniland the response body was silently set to empty — no log, hard to diagnose.In
body_filter, when base64 decoding fails, this now logs an error and leaves the upstream response body unchanged instead of emptying it, mirroring the existing failure handling in thefilterspath of the same plugin. The body is only overwritten on a successful decode.Tests
t/secret/central-secret-refs.tTEST 13/14: a route configured withbody = $env://TEST_NOT_BASE64(resolves to a non-base64 value) andbody_base64 = true; the request returns the unchanged upstream body and an error is logged.Checklist