Bypass007 / vuln

Record some Vulnerabilities
44 stars 18 forks source link

发现一句话 #1

Open huangjacky opened 6 years ago

huangjacky commented 6 years ago

Note that a maximum of 100 request arguments are parsed by default (including those with the same name) and that additional request arguments are silently discarded to guard against potential denial of service attacks.

However, the optional max_args function argument can be used to override this limit:

 local args = ngx.req.get_uri_args(10)

This argument can be set to zero to remove the limit and to process all request arguments received:

 local args = ngx.req.get_uri_args(0)

Removing the max_args cap is strongly discouraged.

huangjacky commented 6 years ago

https://github.com/openresty/lua-nginx-module#ngxreqget_uri_args 不过很多产品在实现的时候,都没有注意到。