do not try to read request body in HTTP2/3 if there's no content-length header (#64)

lib/crowdsec.lua

@@ -90,7 +90,7 @@ function csmod.init(configFile, userAgent)
   runtime.conf["APPSEC_ENABLED"] = false
 
   if runtime.conf["APPSEC_URL"] ~= "" then
-    u = url.parse(runtime.conf["APPSEC_URL"])
+    local u = url.parse(runtime.conf["APPSEC_URL"])
     runtime.conf["APPSEC_ENABLED"] = true
     runtime.conf["APPSEC_HOST"] = u.host
     if u.port ~= nil then
@@ -407,6 +407,13 @@ end
 
 local function get_body()
 
+  -- the LUA module requires a content-length header to read a body for HTTP 2/3 requests, although it's not mandatory.
+  -- This means that we will likely miss body, but AFAIK, there's no workaround for this.
+  -- do not even try to read the body if there's no content-length as the LUA API will throw an error
+  if ngx.req.http_version() >= 2 and ngx.var.http_content_length == nil then
+    ngx.log(ngx.DEBUG, "No content-length header in request")
+    return nil
+  end
   ngx.req.read_body()
   local body = ngx.req.get_body_data()
   if body == nil then
@@ -528,6 +535,8 @@ function csmod.AppSecCheck(ip)
         headers["content-length"] = tostring(#body)
       end
     end
+  else
+    headers["content-length"] = nil
   end
 
   local res, err = httpc:request_uri(runtime.conf["APPSEC_URL"], {
@@ -641,8 +650,11 @@ function csmod.Allow(ip)
     -- we check if the IP need to validate its captcha before checking it against crowdsec local API
     local previous_uri, flags = ngx.shared.crowdsec_cache:get("captcha_"..ip)
     local source, state_id, err = flag.GetFlags(flags)
-    if previous_uri ~= nil and state_id == flag.VERIFY_STATE then
-        ngx.req.read_body()
+    local body = get_body()
+
+    -- nil body means it was likely not a post, abort here because the user hasn't provided a captcha solution
+
+    if previous_uri ~= nil and state_id == flag.VERIFY_STATE and body ~= nil then
         local captcha_res = ngx.req.get_post_args()[csmod.GetCaptchaBackendKey()] or 0
         if captcha_res ~= 0 then
             local valid, err = csmod.validateCaptcha(captcha_res, ip)