lua: add base64Decode() to the stream handle - #46887
Draft
derekargueta wants to merge 2 commits into
Draft
Conversation
Commit Message: lua: add base64Decode() to the stream handle Additional Description: The HTTP Lua filter has offered base64Escape() since envoyproxy#21764 but never a decode counterpart, so a script receiving a base64 value -- a header carrying an encoded claim, an upstream body field that protojson encoded as bytes -- had to either hand-roll a decoder in Lua or reach for a C module that is not present in every Envoy build. base64Decode() returns nil on malformed input rather than raising, so a value that arrived over the wire can be checked instead of trusted. Raising would be awkward here: the common sources are all attacker-influenced, and a Lua error means the filter is skipped entirely, which for an admission-style script turns a deny into an allow. Risk Level: low Testing: unit test covering a known vector, a round trip through base64Escape(), embedded NUL bytes, the empty string, and both invalid-length and invalid-alphabet inputs. Docs Changes: added a base64Decode() entry to the Lua filter docs. Release Notes: added. Platform Specific Features: N/A Fixes envoyproxy#46873 Signed-off-by: Derek Argueta <derek.argueta@airbnb.com>
Picks up test certificate regeneration (envoyproxy#46889); the branch predated it and every TLS cert-validation test was failing as a result.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Commit Message: lua: add base64Decode() to the stream handle
Additional Description:
The HTTP Lua filter has offered
base64Escape()but never a decode counterpart, so a script receiving a base64 value — an encoded header claim, a protojsonbytesfield — has to hand-roll a decoder or depend on a C module that is not in every build. This adds the missing half.base64Decode()returnsnilon malformed input rather than raising. Raising is defensible, but a Lua error skips the filter entirely (StreamHandleWrapper::start()returnsContinueon a not-ok coroutine), which for an admission-style script silently turns a deny into an allow. Returningnillets the script decide.Behaviour follows
absl::Base64Unescape: whitespace is skipped, padding is optional but must be correct if present, and.is accepted alongside=.Risk Level: low
Testing: unit test covering a known vector, a round trip through
base64Escape(), embedded NUL bytes, the empty string decoding to itself rather thannil, and invalid-length and invalid-alphabet inputs returningnil. No integration test, matchingbase64Escape().Docs Changes: added a
base64Decode()entry to the Lua filter docs, with an example checking the result.Release Notes: added.
Platform Specific Features: N/A
On the name:
base64Encode()does not exist and I would rather not add it as an alias.base64Decodeis what #46873 asked for, and Envoy's user-facing vocabulary already leans on encode/decode rather than absl's escape/unescape. Happy to rename tobase64Unescapeif maintainers prefer.Fixes #46873