github_mirrors/attachment
3
0
Fork 1
mirror of https://github.com/openappsec/attachment.git synced 2025-12-31 13:49:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

correct inspection_complete handling

Browse Source
This commit is contained in:
wiaamm
2025-12-01 01:51:25 +02:00
parent 8bdf7a4dd4
commit 0328ddb046
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua
View File

@@ -282,7 +282,6 @@ function NanoHandler.body_filter(conf)
local modifications = result[3] local modifications = result[3]
kong.log.err("CHUNK #", ctx.body_buffer_chunk, " VERDICT: ", verdict, " (INSPECT=", nano.AttachmentVerdict.INSPECT, ", ACCEPT=", nano.AttachmentVerdict.ACCEPT, ", DROP=", nano.AttachmentVerdict.DROP, ")") kong.log.err("CHUNK #", ctx.body_buffer_chunk, " VERDICT: ", verdict, " (INSPECT=", nano.AttachmentVerdict.INSPECT, ", ACCEPT=", nano.AttachmentVerdict.ACCEPT, ", DROP=", nano.AttachmentVerdict.DROP, ")")
kong.log.err("Response body chunk verdict: ", verdict, " (chunk #", ctx.body_buffer_chunk, ")")
if modifications then if modifications then
chunk = nano.handle_body_modifications(chunk, modifications, ctx.body_buffer_chunk) chunk = nano.handle_body_modifications(chunk, modifications, ctx.body_buffer_chunk)
@@ -299,18 +298,19 @@ function NanoHandler.body_filter(conf)
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil
return custom_result return custom_result
else
kong.log.err("nano.send_body failed, failing open: ", tostring(result))
end end
else else
-- Inspection already complete - just count the chunk and pass through kong.log.err("nano.send_body failed, failing open: ", tostring(result))
kong.log.err("CHUNK #", ctx.body_buffer_chunk, " - skipping nano.send_body (inspection complete)")
ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1
end end
else
-- Inspection already complete - just count the chunk and pass through
kong.log.err("CHUNK #", ctx.body_buffer_chunk, " - skipping nano.send_body (inspection complete)")
ctx.body_buffer_chunk = ctx.body_buffer_chunk + 1
end end
end end
if eof or (ctx.expect_body == false and not ctx.body_seen) then -- Only process EOF if inspection is not yet complete (session still active)
if not ctx.inspection_complete and (eof or (ctx.expect_body == false and not ctx.body_seen)) then
local ok, result = pcall(function() local ok, result = pcall(function()
return {nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_RESPONSE_END)} return {nano.end_inspection(session_id, session_data, nano.HttpChunkType.HTTP_RESPONSE_END)}
end) end)
@@ -328,6 +328,7 @@ function NanoHandler.body_filter(conf)
ctx.session_id = nil ctx.session_id = nil
ctx.session_data = nil ctx.session_data = nil
ctx.plugin.blocked = true ctx.plugin.blocked = true
ctx.inspection_complete = true
return custom_result return custom_result
end end
else else