openresty / openresty/lua-nginx-module

ngx.req.set_header(key, value ) in kong plugin should throw error for BWS ("bad" whitespace) in header key

Open
#2,140 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
11.8k
Forks
2.1k
Avg merge
6h 1m
Merged PRs (30d)
6

Description

Current Behavior

Adding header ngx.req.set_header("X-cnn-Service ", "") to a plugin is causing the request to throw HTTP 400 error due to the additional trailing whitespace in header's Key.
reference- field-parsing according to rfc7230 No whitespace is allowed between the header field-name and colon .
Due to a small leading/trailing whitespace mistake , much of the developers time is wasted to find this issue .

Expected Behavior

Two ideas can be proposed

  1. Trim the leading/trailing whitespace of the header before plugin execution.
  2. Log the error , that plugin execution failed for the request due to invalid header
Steps To Reproduce
Create a Plugin with the following in access.lua
`
local BasePlugin = require "kong.plugins.base_plugin"
local priorities = require "kong.plugins.priorities"

local plugin_name = "headers-plugin"

local KongHeadersHandler = BasePlugin:extend()

function KongHeadersHandler:new()
   KongHeadersHandler.super.new(self, plugin_name)
end

function KongHeadersHandler:access(conf)
  KongHeadersHandler.super.access(self)
  ngx.req.set_header("X-cnn-Service ", "")
end

KongHeadersHandler.PRIORITY = priorities[plugin_name]
KongHeadersHandler.VERSION = "0.0.1"

return KongHeadersHandler`

kong version 1.1.2
lua version Lua 5.1.4
LuaJIT 2.1.0-beta3
nginx version: openresty/1.13.6.2
LuaRocks main command-line interface /opt/kong/luajit/bin/luarocks 3.2.1

For ngx.header also it should trim white space or throw error instead of sending invalid header

example

header_filter_by_lua_block {
                ngx.header.Foo = "blah"
                ngx.header["name "] = 'X-12345'
            }

output

< Connection: keep-alive
< Foo: blah
< name%20: X-12345

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the trailing-space cases at ngx.req.set_header in the plugin's access.lua and at ngx.header in header_filter_by_lua_block. Read the handling behind these entry points and compare the observed HTTP 400 or encoded header output with RFC 7230; done means the intended invalid-header behavior is defined and covered for both APIs.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.