blaisewang opened a new pull request, #13763: URL: https://github.com/apache/apisix/pull/13763
### Description `lua-resty-t1k` 1.2.0 can report the **response** to the SafeLine WAF detection service in addition to the request. This PR bumps the dependency and exposes the capability through the `chaitin-waf` plugin. Until now the plugin only reported requests, so anything the WAF could have detected on the way out — data leaks in a response body, a successful exploit's output, an unexpected status code — was invisible to SafeLine. Enabling response reporting closes that gap without changing how requests are handled. Three new `config` options, available both at plugin level and in the plugin metadata: | Option | Type | Default | Description | |---|---|---|---| | `log_resp` | boolean | `false` | Report the response to the WAF service. | | `resp_body_size` | integer (`>= 0`) | `4` | How much of the response body to report, in KB. `0` reports only the status line and headers. | | `extra_ignored_content_types` | string | — | Comma separated response `Content-Type` values to skip, on top of the built-in list. | How it works: - The plugin now implements the `body_filter` and `log` phases, delegating to `t1k.do_body_filter()` and `t1k.do_log()`. - `body_filter` buffers up to `resp_body_size` KB of the response body; the report itself is sent from an `ngx.timer` during the log phase, **after** the response has been handed back to the client. It therefore adds no latency to the response. - The report is **advisory only**: detection results appear in the SafeLine console, and APISIX never blocks or modifies a response based on them. Request handling is unchanged. - Responses are skipped when the request was already blocked, or when the response `Content-Type` is in the ignored list (audio, video, font, image and other binary media types out of the box). One refactor was needed along the way: `get_conf` applied the metadata and plugin level `config` blocks with two verbatim copies of the same field-by-field assignment. Adding three more options would have meant keeping three copies in sync, so both are folded into a local helper. Precedence is unchanged — plugin level config still overrides metadata. Docs updated in both `en` and `zh`, including a new "Response Logging" section that covers the async reporting model, the skip conditions, and the memory cost of buffering response bodies on routes serving large responses. #### Which issue(s) this PR fixes: N/A — no existing issue; this adds a new capability to the plugin. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
