fix block page

attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua

@@ -80,13 +80,14 @@ function NanoHandler.access(conf)
         kong.log.err("DROP verdict in access/send_data - session_id: ", session_id)
         kong.ctx.plugin.blocked = true
         kong.ctx.plugin.inspection_complete = true
-        nano.handle_custom_response(session_data, response)
+        local result = nano.handle_custom_response(session_data, response)
-        -- Free response AFTER using it
-        nano.free_response_immediate(response)
         nano.fini_session(session_data)
+        -- Free response AFTER using it, then cleanup all resources
+        nano.free_response_immediate(response)
+        nano.cleanup_all()
         kong.ctx.plugin.session_id = nil
         kong.ctx.plugin.session_data = nil
-        return
+        return result
     end
 
     if contains_body == 1 then
@@ -97,13 +98,13 @@ function NanoHandler.access(conf)
                 kong.log.err("DROP verdict in access/send_body (raw) - session_id: ", session_id)
                 kong.ctx.plugin.blocked = true
                 kong.ctx.plugin.inspection_complete = true
-                nano.handle_custom_response(session_data, response)
+                local result = nano.handle_custom_response(session_data, response)
-                -- Free response AFTER using it
-                nano.free_response_immediate(response)
                 nano.fini_session(session_data)
+                nano.free_response_immediate(response)
+                nano.cleanup_all()
                 kong.ctx.plugin.session_id = nil
                 kong.ctx.plugin.session_data = nil
-                return
+                return result
             end
             -- Free body from memory after sending
             body = nil
@@ -119,13 +120,13 @@ function NanoHandler.access(conf)
                     kong.log.err("DROP verdict in access/send_body (var) - session_id: ", session_id)
                     kong.ctx.plugin.blocked = true
                     kong.ctx.plugin.inspection_complete = true
-                    nano.handle_custom_response(session_data, response)
+                    local result = nano.handle_custom_response(session_data, response)
-                    -- Free response AFTER using it
-                    nano.free_response_immediate(response)
                     nano.fini_session(session_data)
+                    nano.free_response_immediate(response)
+                    nano.cleanup_all()
                     kong.ctx.plugin.session_id = nil
                     kong.ctx.plugin.session_data = nil
-                    return
+                    return result
                 end
                 -- Free body_data from memory
                 body_data = nil
@@ -146,13 +147,13 @@ function NanoHandler.access(conf)
                                 kong.log.err("DROP verdict in access/send_body (file) - session_id: ", session_id)
                                 kong.ctx.plugin.blocked = true
                                 kong.ctx.plugin.inspection_complete = true
-                                nano.handle_custom_response(session_data, response)
+                                local result = nano.handle_custom_response(session_data, response)
-                                -- Free response AFTER using it
-                                nano.free_response_immediate(response)
                                 nano.fini_session(session_data)
+                                nano.free_response_immediate(response)
+                                nano.cleanup_all()
                                 kong.ctx.plugin.session_id = nil
                                 kong.ctx.plugin.session_data = nil
-                                return
+                                return result
                             end
                             -- Free entire_body from memory
                             entire_body = nil
@@ -188,13 +189,13 @@ function NanoHandler.access(conf)
         kong.log.err("DROP verdict in access/end_inspection - session_id: ", session_id)
         kong.ctx.plugin.blocked = true
         kong.ctx.plugin.inspection_complete = true
-        nano.handle_custom_response(session_data, response)
+        local result = nano.handle_custom_response(session_data, response)
-        -- Free response AFTER using it
-        nano.free_response_immediate(response)
         nano.fini_session(session_data)
+        nano.free_response_immediate(response)
+        nano.cleanup_all()
         kong.ctx.plugin.session_id = nil
         kong.ctx.plugin.session_data = nil
-        return
+        return result
     end
 end
 
@@ -234,13 +235,13 @@ function NanoHandler.header_filter(conf)
         kong.log.err("DROP verdict in header_filter - session_id: ", ctx.session_id)
         ctx.blocked = true
         ctx.inspection_complete = true
-        nano.handle_custom_response(ctx.session_data, response)
+        local result = nano.handle_custom_response(ctx.session_data, response)
-        -- Free response AFTER using it
-        nano.free_response_immediate(response)
         nano.fini_session(ctx.session_data)
+        nano.free_response_immediate(response)
+        nano.cleanup_all()
         ctx.session_id = nil
         ctx.session_data = nil
-        return
+        return result
     elseif verdict == nano.AttachmentVerdict.ACCEPT then
         kong.log.debug("ACCEPT verdict in header_filter - marking inspection complete")
         ctx.inspection_complete = true
@@ -313,13 +314,13 @@ function NanoHandler.body_filter(conf)
                 kong.log.err("DROP verdict in body_filter/send_body - session_id: ", ctx.session_id)
                 ctx.blocked = true
                 ctx.inspection_complete = true
-                nano.handle_custom_response(ctx.session_data, response)
+                local result = nano.handle_custom_response(ctx.session_data, response)
-                -- Free response AFTER using it
-                nano.free_response_immediate(response)
                 nano.fini_session(ctx.session_data)
+                nano.free_response_immediate(response)
+                nano.cleanup_all()
                 ctx.session_id = nil
                 ctx.session_data = nil
-                return
+                return result
             elseif verdict == nano.AttachmentVerdict.ACCEPT then
                 -- Final ACCEPT verdict received - mark complete but don't cleanup yet (wait for EOF)
                 kong.log.debug("ACCEPT verdict received - session finalized")
@@ -357,13 +358,13 @@ function NanoHandler.body_filter(conf)
                     kong.log.err("DROP verdict in body_filter/end_inspection - session_id: ", ctx.session_id)
                     ctx.blocked = true
                     ctx.inspection_complete = true
-                    nano.handle_custom_response(ctx.session_data, response)
+                    local result = nano.handle_custom_response(ctx.session_data, response)
-                    -- Free response AFTER using it
-                    nano.free_response_immediate(response)
                     nano.fini_session(ctx.session_data)
+                    nano.free_response_immediate(response)
+                    nano.cleanup_all()
                     ctx.session_id = nil
                     ctx.session_data = nil
-                    return
+                    return result
                 end
             else
                 kong.log.err("nano.end_inspection failed: ", tostring(result), " - cleaning up session")

attachments/kong/plugins/open-appsec-waf-kong-plugin/nano_ffi.lua

@@ -90,8 +90,7 @@ function nano.handle_custom_response(session_data, response)
 
     if not attachment then
         kong.log.warn("Cannot handle custom response: Attachment not available for worker ", worker_id, " - failing open")
-        kong.response.exit(200, "Request allowed due to attachment unavailability")
+        return kong.response.exit(200, "Request allowed due to attachment unavailability")
-        return
     end
 
     local response_type = nano_attachment.get_web_response_type(attachment, session_data, response)
@@ -104,22 +103,19 @@ function nano.handle_custom_response(session_data, response)
             code = 403
         end
         kong.log.err("Response code only: ", code)
-        kong.response.exit(code, "")
+        return kong.response.exit(code, "")
-        return
     end
 
     if response_type == nano.WebResponseType.REDIRECT_WEB_RESPONSE then
         local location = nano_attachment.get_redirect_page(attachment, session_data, response)
         kong.log.err("Redirect response to: ", location)
-        kong.response.exit(307, "", { ["Location"] = location })
+        return kong.response.exit(307, "", { ["Location"] = location })
-        return
     end
 
     local block_page = nano_attachment.get_block_page(attachment, session_data, response)
     if not block_page then
         kong.log.err("Failed to retrieve custom block page for session ", session_data)
-        kong.response.exit(500, { message = "Internal Server Error" })
+        return kong.response.exit(500, { message = "Internal Server Error" })
-        return
     end
     local code = nano_attachment.get_response_code(response)
     if not code or code < 100 or code > 599 then
@@ -127,7 +123,7 @@ function nano.handle_custom_response(session_data, response)
         code = 403
     end
     kong.log.err("Block page response with code: ", code, ", page length: ", #block_page)
-    kong.response.exit(code, block_page, { ["Content-Type"] = "text/html" })
+    return kong.response.exit(code, block_page, { ["Content-Type"] = "text/html" })
 end
 
 
@@ -428,12 +424,7 @@ function nano.fini_session(session_data)
     end
 
     nano_attachment.fini_session(attachment, session_data)
-    
+    kong.log.info("Successfully finalized session ", session_data, " for worker ", worker_id)
-    -- CRITICAL: Free all accumulated resources when session ends
-    -- This prevents memory leaks from responses, headers, metadata, etc.
-    nano.cleanup_all()
-    
-    kong.log.err("Successfully finalized session ", session_data, " for worker ", worker_id)
     return true
 end