request-validation插件可以检查HTTP请求头和BODY内容,当不符合用户配置的规则时,请求就不会转发到上游。 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '{ "uri": "/10", "plugins": { "request-validation 比如{"string_payload":"","string_payload":"1111"},request-validation插件会认为string_payload="1111"。 因此request-validation插件和上游服务在解析json时可能存在差异性,所以会导致限制被绕过哪些库和request-validation插件在解析"重复键值json"时存在差异? 根据 https://bishopfox.com/blog/json-interoperability-vulnerabilities 文章,可以知道最起码以下库和request-validation插件在解析
serverless-pre-function - batch-requests - cors - ip-restriction - ua-restriction - referer-restriction - uri-blocker - request-validation prometheus - proxy-cache - proxy-mirror - proxy-rewrite - redirect - referer-restriction - request-id - request-validation
proxy-mirror - proxy-rewrite - public-api - real-ip - redirect - referer-restriction - request-id - request-validation
proxy-cache - proxy-mirror - proxy-rewrite - redirect - referer-restriction - request-id - request-validation
request-validation:该插件用于提前验证向上游服务转发的请求。 proxy-mirror:该插件提供了镜像客户端请求的能力。
proxy-mirror - proxy-rewrite - redirect - referer-restriction - request-id - request-validation
# priority: 2980 - uri-blocker # priority: 2900 - request-validation