• post请求体过大导致ngx.req.get_post_args()取不到参数体的问题


    http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size

    该地址对于client_body_buffer_size配置做了说明

    syntax: client_body_buffer_size size

    default: client_body_buffer_size 8k|16k

    context: http,server,location

    Sets buffer size for reading client request body. In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. By default, buffer size is equal to two memory pages. This is 8K on x86, other 32-bit platforms, and x86-64. It is usually 16K on other 64-bit platforms.

    为读取客户端请求体设置缓存区大小。为了防止请求体超过缓存区大小,将整个请求体或其中一分部写入一个临时文件。默认缓存区大小为two memory pages。在x86、32位机器、x86-64上是8k,其它64位机器上是16k。

    解决方案有两种:

    1、调大client_body_buffer_size值

    client_body_buffer_size 128k

    client_max_body_size 100m

    这两个参数配合使用,如果总body_size超过这个值,请求会被拒绝

    2、去临时文件读取请求体

    需要用到ngx.req.get_body_file,从临时文件读取数据

    --Nginx服务器中使用lua获取get或post参数
    local request_method = ngx.var.request_method
    local args = nil
    local param = nil
    local param2 = nil
    --获取参数的值
    if "GET" == request_method then
        args = ngx.req.get_uri_args()
    elseif "POST" == request_method then
        ngx.req.read_body()
        args = ngx.req.get_post_args()
    end
    param = args["param"]
    param2 = args["param2"]
    --升级版(能处理content-type=multipart/form-data的表单):
    local function explode ( _str,seperator )
        local pos, arr = 0, {}
            for st, sp in function() return string.find( _str, seperator, pos, true ) end do
                table.insert( arr, string.sub( _str, pos, st-1 ) )
                pos = sp + 1
            end
        table.insert( arr, string.sub( _str, pos ) )
        return arr
    end
    local args = {}
    local file_args = {}
    local is_have_file_param = false
    local function init_form_args()
        local receive_headers = ngx.req.get_headers()
        local request_method = ngx.var.request_method
        if "GET" == request_method then
            args = ngx.req.get_uri_args()
        elseif "POST" == request_method then
            ngx.req.read_body()
                --判断是否是multipart/form-data类型的表单
            if string.sub(receive_headers["content-type"],1,20) == "multipart/form-data;" then   
                is_have_file_param = true
                content_type = receive_headers["content-type"]
                --body_data可是符合http协议的请求体,不是普通的字符串
                body_data = ngx.req.get_body_data()
                --请求体的size大于nginx配置里的client_body_buffer_size,则会导致请求体被缓冲到磁盘临时文件里,client_body_buffer_size默认是8k或者16k
                if not body_data then
                    local datafile = ngx.req.get_body_file()
                    if not datafile then
                        error_code = 1
                        error_msg = "no request body found"
                    else
                        local fh, err = io.open(datafile, "r")
                        if not fh then
                            error_code = 2
                            error_msg = "failed to open " .. tostring(datafile) .. "for reading: " .. tostring(err)
                        else
                            fh:seek("set")
                            body_data = fh:read("*a")
                            fh:close()
                            if body_data == "" then
                                error_code = 3
                                error_msg = "request body is empty"
                            end
                        end
                    end
                end
                local new_body_data = {}
                --确保取到请求体的数据
                if not error_code then
                    local boundary = "--" .. string.sub(receive_headers["content-type"],31)
                    local body_data_table = explode(tostring(body_data),boundary)
                    local first_string = table.remove(body_data_table,1)
                    local last_string = table.remove(body_data_table)
                    for i,v in ipairs(body_data_table) do
                        local start_pos,end_pos,capture,capture2 = string.find(v,'Content%-Disposition: form%-data; name="(.+)"; filename="(.*)"')
                        --普通参数
                        if not start_pos then
                            local t = explode(v,"rnrn")
                            local temp_param_name = string.sub(t[1],41,-2)
                            local temp_param_value = string.sub(t[2],1,-3)
                            args[temp_param_name] = temp_param_value
                        else
                        --文件类型的参数,capture是参数名称,capture2是文件名                            
                            file_args[capture] = capture2
                            table.insert(new_body_data,v)
                        end
                    end
                    table.insert(new_body_data,1,first_string)
                    table.insert(new_body_data,last_string)
                    --去掉app_key,app_secret等几个参数,把业务级别的参数传给内部的API
                    body_data = table.concat(new_body_data,boundary)--body_data可是符合http协议的请求体,不是普通的字符串
                end
            else
                args = ngx.req.get_post_args()
            end
        end
    end
  • 相关阅读:
    【移动安全基础篇】——30、class.dex文件格式讲解
    【移动安全基础篇】——29、Android源码定制添加反反调试机制
    【移动安全基础篇】——28、Apk加固
    【移动安全基础篇】——27、常用调试检测方法与过检测方法
    【移动安全基础篇】——26、两个简单app破解
    粒子特效优化
    android studio生成aar包
    AndroidManifest
    声音
    unity webview
  • 原文地址:https://www.cnblogs.com/wangzhisdu/p/7771310.html
Copyright © 2020-2023  润新知