You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The thing is, that parameter will NOT be set to true for HTTP 2 requests with trailers. This is because end_of_stream is set to true only if no more payload chunks will arrive AND there will be no request trailers.
This scenario may be easily omitted, as it doesn't happen for HTTP 1 - even though HTTP standard allows adding request trailers, the Envoy team has decided to not trigger onRequestTrailers for HTTP 1 as most servers do not support trailers properly for HTTP 1.
To address the issue, I've raised a PR with solution proposal #288. It also contains the demo directory which is meant for reviewers to easily investigate the issue and see how the change affects the problem. The demo directory is not intended to be merged in the final stage.
The text was updated successfully, but these errors were encountered:
I investigated a bit more the root cause. OnHttpRequestBody current expected behaviour (in a simplified version) is the following:
returns types.ActionPause as far as endOfStream is set to false, buffering all the body chunks.
Once endOfStream is set to true, it means that the whole body has been received. So tx.ProcessRequestBody() is called, and if no interruption is raised, the stream is let continue via return types.ActionContinue.
The interesting behavior with a request that comes with trailers is that the return types.ActionPause is not honored, and the stream continues flowing by triggering OnHttpRequestTrailers.
The Coraza Envoy WASM plugin contains a bug that allows bypassing request payload scanning for HTTP 2 requests with trailers
I've described it in the README.md located there https://github.com/iosetek/coraza-proxy-wasm/blob/fix-bypassing-request-body-scanning/demo/trailer_bypass_attack/README.md
The existing implementation triggers request payload scanning when end_of_stream parameter is set to true:
coraza-proxy-wasm/wasmplugin/plugin.go
Line 432 in d1d6f28
The thing is, that parameter will NOT be set to true for HTTP 2 requests with trailers. This is because end_of_stream is set to true only if no more payload chunks will arrive AND there will be no request trailers.
This scenario may be easily omitted, as it doesn't happen for HTTP 1 - even though HTTP standard allows adding request trailers, the Envoy team has decided to not trigger onRequestTrailers for HTTP 1 as most servers do not support trailers properly for HTTP 1.
To address the issue, I've raised a PR with solution proposal #288. It also contains the demo directory which is meant for reviewers to easily investigate the issue and see how the change affects the problem. The demo directory is not intended to be merged in the final stage.
The text was updated successfully, but these errors were encountered: