feat: add max_post_args_readable_size to bound post_arg.* body reads#13601
Open
shreemaan-abhishek wants to merge 1 commit into
Open
feat: add max_post_args_readable_size to bound post_arg.* body reads#13601shreemaan-abhishek wants to merge 1 commit into
shreemaan-abhishek wants to merge 1 commit into
Conversation
Matching post_arg.* route predicates parses the full request body for JSON and multipart requests. Add a configurable cap (apisix.max_post_args_readable_size, default 64 MB, 0 to disable) so large bodies are not read into worker memory during route matching.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Route matching supports
post_arg.*predicates. Forapplication/jsonandmultipart/form-datarequests, resolving these predicates inapisix/core/ctx.luacallsrequest.get_request_body_table()with no size limit, so the full request body (including temp-file-backed bodies) is parsed into worker memory during the access-phase matching.This PR adds a configurable bound:
apisix.max_post_args_readable_size(in MB, default64,0disables the limit).post_arg.*matching now passes this cap to the body reader. Bodies larger than the cap are not read; the predicate resolves toniland the route simply does not match.x-www-form-urlencodedalready goes through nginx's boundedget_post_args).Added schema validation, updated
config.yaml.example, the router-radixtree docs, and tests int/core/ctx3.t(oversized body is not read and the route does not match; within-cap body still matches).Which issue(s) this PR fixes:
Fixes #
Checklist