Skip to content

fix: process request body once at EOS and correct status/filter bugs - #91

Open
fzipi wants to merge 1 commit into
owasp-modsecurity:masterfrom
fzipi:fix/request-body-processing
Open

fix: process request body once at EOS and correct status/filter bugs#91
fzipi wants to merge 1 commit into
owasp-modsecurity:masterfrom
fzipi:fix/request-body-processing

Conversation

@fzipi

@fzipi fzipi commented Jul 25, 2026

Copy link
Copy Markdown

Summary

  • Process the request body once at EOS instead of once per bucket, by moving msc_process_request_body() into the handler phase (hook_request_late) and only buffering chunks in the input filter
  • Register hook_request_late via ap_hook_handler (not fixups) and read the body with ap_setup_client_block()/ap_get_client_block() so the input filter actually runs; create the transaction context in hook_insert_filter if it doesn't exist yet
  • Set r->status in addition to r->status_line so interventions return the configured HTTP status instead of a default
  • Fix input_filter() calling ap_remove_output_filter() instead of ap_remove_input_filter()
  • Check the apr_bucket_read() return value in output_filter()

Test plan

  • Built the connector and confirmed the module loads in Apache
  • Verified via Docker smoke test (see companion PR) that normal requests return 200, query-string rule matches return 403, and status codes set by interventions are passed through correctly

- Move msc_process_request_body() into the handler phase
  (hook_request_late) instead of calling it per input-filter bucket
- Register hook_request_late via ap_hook_handler (not fixups) and read
  the body with ap_setup_client_block()/ap_get_client_block() so the
  input filter runs; create the transaction context in
  hook_insert_filter if missing
- Set r->status in addition to r->status_line so interventions return
  the configured HTTP status
- Fix input_filter() calling ap_remove_output_filter() instead of
  ap_remove_input_filter()
- Check apr_bucket_read() return value in output_filter()

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@fzipi fzipi changed the title Fix request body processing, status codes, and filter bugs fix: process request body once at EOS and correct status/filter bugs Jul 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant