shreemaan-abhishek opened a new pull request, #13469:
URL: https://github.com/apache/apisix/pull/13469
### Description
This PR hardens three plugins against malformed or edge-case requests that
currently surface as `500` errors or leak sensitive data into the logs.
- **cors**: `process_with_allow_origins_by_regex` passes the request
`Origin` header straight to `ngx.re.find`. When a request arrives without an
`Origin` header (`nil`), this raises and the request fails with a `500`. Added
an early nil guard so such requests are handled gracefully.
- **multi-auth**: when an auth sub-plugin returns a status code with a `nil`
error message, the error-string concatenation `.. err` throws, turning a `401`
into a `500`. Made the concatenation nil-safe with `(err or "")`.
- **body-transformer**:
- The `multipart` decoder called the `multipart` library directly, so a
malformed multipart body raised an error and produced a `500` instead of a
`400`. The decode is now wrapped in `pcall` and returns the error to the caller.
- The post-decode `nil` check now runs before `get_all_with_arrays()` is
invoked, so a failed decode is reported instead of calling a method on a nil
value.
- On a decode error the raw request body was written to the error log,
which can leak credentials/PII and amplify log volume for a malformed body. It
now logs the body size instead.
- Removed a redundant `local ok` redeclaration that shadowed the outer
`ok`.
#### Which issue(s) this PR fixes:
Fixes #
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
