shreemaan-abhishek commented on PR #14016: URL: https://github.com/apache/apisix/pull/14016#issuecomment-6057571813
Updated in 48eae3306 after review on the paired EE PR. Three fixes: - `inflate_gzip` consumed only the first member of a concatenated gzip stream (RFC 1952 section 2.2), so a multi-member body was silently truncated. It now drives `createStream` / `initInflate` / `inflate` per member, rewinding its input position by `stream.avail_in` after each, bounds the members' total with one cumulative counter, and rejects bytes trailing the last member. This also affects `content-decode.lua`, so a multi-member gzip *response* stops being truncated too. - The plugin on both a global rule and a route compressed the body twice, since `common_phase` runs global rules and then route plugins. `run_policy = "prefer_route"` gives the request to the route's instance, which also fixes the precedence of `forward_compressed` and `max_req_body_size`, and the forwarding state is now consumed on first use. - A body over `max_req_body_size` answered 500. `read_body` classifies a size violation as `too_large` and `get_body` passes the kind on, so the Content-Length, chunked and file-backed paths all answer 413. Tests grew to 40 blocks in `t/plugin/request-decompress.t` and 6 in `t/utils/gzip.t`, covering multi-member payloads, cumulative overflow, a corrupt later member, trailing bytes, global rule plus route stacking, and the three size-violation input shapes. Docs updated for all three. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
