HY-love-sleep opened a new pull request, #7155:
URL: https://github.com/apache/shenyu/pull/7155
### Motivation
#7153 added the sensitive word plugin, but the plugin was not registered in
the admin: no `plugin`
row and no `plugin_handle` rows, so no console form and no menu entry. This
is the follow up tracked
in #7154.
### What is added
**1. The admin rows, for every dialect** (`db/init/{mysql,ob,pg,og,oracle}`
plus the h2 script the
admin uses):
- the `plugin` row (id `67`, role `Ai`, sort `197`, the order of
`PluginEnum.SENSITIVE_WORD`);
- 14 `plugin_handle` rows: the redis client of the plugin (plugin level) and
the five rule fields;
- the 10 `resource` rows of the menu and the 10 `permission` rows binding
them to the default role;
- the two `failClosed` options in `shenyu_dict`, so the console renders a
select for it;
- the `namespace_plugin_rel` row.
`db/upgrade/2.7.1-upgrade-2.7.2-{mysql,ob,og,oracle,pg}.sql` carries the
same rows for an existing
installation, and `db/upgrade/upgrade-guide.md` lists the new pair.
**2. `words` on the rule.** A small list can now be configured from the
console form directly,
separated by commas or by new lines, and it is merged with the redis set the
rule points at. This
answers the request to support a simple word list from the configuration
side: a large list still
belongs in redis, and the console renders `words` as the generic single line
input, so no
`shenyu-dashboard` change is involved.
**3. `maxBodySize`.** The largest body that is scanned, in bytes (`0` scans
every body):
- the declared `Content-Length` is checked **before** the body is buffered,
so an oversized request
is never read into memory;
- a body whose size is not declared (a chunked request) is checked once it
has been read;
- an oversized request is passed through unscanned with a warning, or
**rejected** when the rule is
`failClosed`, for the deployments that would rather block than let
unfiltered content through.
### Notes on the plugin changes
- The dictionary cache is keyed by the redis key **and** the words of the
rule, so two rules reading
the same redis set with different words never share an automaton, and a
changed word list is
compiled again. A rule change drops the cached dictionary of both the
previous and the new handle.
- The words of the rule do not depend on redis: when the set cannot be read
they are still enforced,
which also softens the fail open default (a broken redis no longer means
"no filtering at all" for
such a rule).
### Not included
**Uploading a word list file from the console.** It would need a redis
client inside `shenyu-admin`
(the admin has none today), an upload endpoint with its size limit, encoding
and audit rules, plus a
component in the separate `shenyu-dashboard` repository. Redis remains the
way to feed a large list
and the module README documents it, so this is left out of the PR rather
than half done — happy to
continue on it as a separate issue if it is wanted.
### Testing
```
./mvnw -pl
shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-sensitive-word,<starter> -am
-Djacoco.skip=true test
./mvnw -pl shenyu-common -Dtest=SensitiveWordHandleTest test
```
- 40 tests in the plugin module (16 plugin, 14 automaton, 10 handler), 2 in
the starter and 5 in the
dto, no failure, checkstyle 0, RAT ok.
- The new tests cover the words of the rule alone, the words merged with the
redis set, the words
enforced while redis is down, and both `maxBodySize` policies (including a
body whose size is not
declared).
- The sql was verified twice: the h2 script is executed with H2
(`org.h2.tools.RunScript` in MySQL
mode) so the new rows are known to be valid, and every `INSERT` of the
touched files was checked
against the column count of its table, which is how a missing pair of date
columns was caught
before the push.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
