[PR] fix(request-validation): guard non-string Content-Type before lower() [apisix]

["shreemaan-abhishek (via GitHub)" <gi...@apache.org>]

shreemaan-abhishek opened a new pull request, #13691:
URL: https://github.com/apache/apisix/pull/13691

   ### Description
   
   The `request-validation` plugin decides whether a request body is form-urlencoded by lowercasing the `Content-Type` header and prefix-matching it:
   
   ```lua
   if headers["content-type"]
       and core.string.has_prefix(headers["content-type"]:lower(), "application/x-www-form-urlencoded")
   then
   ```
   
   `headers` comes from `ngx.req.get_headers()`, which returns a **table** (not a string) when a header appears more than once. So a request that carries a duplicated `Content-Type` header makes `headers["content-type"]` a table, and `table:lower()` raises `attempt to call method 'lower' (a nil value)` in the `rewrite` phase. The request then fails with a 500 and an error log, instead of being validated (or cleanly rejected).
   
   This PR guards the value with a string type check before calling `:lower()`. A non-string `Content-Type` now falls through to the JSON default path, matching the plugin's intent for anything that is not form-urlencoded.
   
   While here, the existing charset test used an all-lowercase media type, so it never actually exercised the `:lower()` call; it now uses a mixed-case media type. A new test covers the duplicated-header path.
   
   #### Which issue(s) this PR fixes:
   Fixes #
   
   ### Checklist
   
   - [x] I have explained the need for this PR and the problem it solves
   - [x] I have explained the changes or the new features added to this PR
   - [x] I have added tests corresponding to this change
   - [ ] I have updated the documentation to reflect this change
   - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
   
   <!-- Docs unchanged: this is an internal robustness fix; the documented schema-validation behavior is unchanged. -->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(request-validation): guard non-string Content-Type before lower() [apisix]

["membphis (via GitHub)" <gi...@apache.org>]

membphis commented on PR #13691:
URL: https://github.com/apache/apisix/pull/13691#issuecomment-4954522495

   [P2] Conflicting duplicate Content-Type values can bypass consistent body representation validation
   
   When `Content-Type` appears more than once, `ngx.req.get_headers()` returns a table. This change falls through to JSON validation, while the original duplicate headers are still forwarded upstream. Different upstreams may select the first value, the last value, or reject the request, so APISIX can validate one representation while the upstream parses another.
   
   Please reject conflicting duplicate `Content-Type` values (or only accept duplicates after confirming all normalized values are identical), and add tests for both header orders. RFC 9110 Section 8.3 explicitly warns that repeated `Content-Type` values can create interoperability and security issues when recipients handle them differently.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(request-validation): guard non-string Content-Type before lower() [apisix]

["shreemaan-abhishek (via GitHub)" <gi...@apache.org>]

shreemaan-abhishek merged PR #13691:
URL: https://github.com/apache/apisix/pull/13691


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org