nic-chen opened a new issue #3082: URL: https://github.com/apache/apisix/issues/3082
### Issue description ### Environment * apisix version (cmd: `apisix version`): master * OS: mac ### Minimal test code / Steps to reproduce the issue 1. create a global rule ```sh $ curl http://127.0.0.1:9080/apisix/admin/global_rules/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d ' { "id": "1", "plugins": { "response-rewrite": { "headers": { "X-VERSION":"1.0" } }, "uri-blocker": { "block_rules": ["select.+(from|limit)", "(?:(union(.*?)select))"] } } }' ``` 2. create a route ```sh $ curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -i -d ' { "uri": "/hello", "plugins": { "response-rewrite": { "headers": { "X-VERSION":"2.0" } } }, "upstream": { "type": "roundrobin", "nodes": [{ "host": "172.16.238.20", "port": 1981, "weight": 1 }] } }' ``` 3. hit the route ```sh $ curl "http://127.0.0.1:9080/hello?name=;select%20from%20sys"; -i ``` ### What's the actual result? (including assertion message & call stack if applicable) ```sh HTTP/1.1 403 Forbidden Date: Sun, 20 Dec 2020 13:06:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: keep-alive Server: APISIX/2.1 X-VERSION: 1.0 ``` ### What's the expected result? X-VERSION should be 2.0 ### Additional information If not trigger `uri-blocker`, it works fine. ```sh $ curl http://127.0.0.1:9080/hello -i HTTP/1.1 200 OK Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: APISIX/2.1 X-VERSION: 2.0 ``` ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
