Repository: envoyproxy/envoy
File: api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto (Protocol Buffers)

Code before:
  //   Processing request modifiers are currently in alpha.
  //
  // [#extension-category: envoy.http.ext_proc.processing_request_modifiers]
  config.core.v3.TypedExtensionConfig processing_request_modifier = 25
      [(xds.annotations.v3.field_status).work_in_progress = true];

  // Decorator to introduce custom logic that runs after a message received from
  // the External Processor is processed, but before continuing filter chain iteration.
  //
  // .. note::
  //   Response processors are currently in alpha.
  //
  // [#extension-category: envoy.http.ext_proc.response_processors]
  config.core.v3.TypedExtensionConfig on_processing_response = 23
      [(xds.annotations.v3.field_status).work_in_progress = true];

  // Sets the HTTP status code that is returned to the client when the external processing server returns
  // an error, fails to respond, or cannot be reached.
  //
  // The default status is ``HTTP 500 Internal Server Error``.
  type.v3.HttpStatus status_on_error = 24;

  // If true, the filter will not remove the ``content-length`` header from the request/response after external processing.
  // It is typically used in
  // :ref:`FULL_DUPLEX_STREAMED <envoy_v3_api_enum_value_extensions.filters.http.ext_proc.v3.ProcessingMode.BodySendMode.FULL_DUPLEX_STREAMED>`
  // mode. If the original body has been modified, the external processing server needs to set the correct content-length header in HeaderMutation
  // that matches the modified body length.
  //
  // .. warning::
  //
  //    This configuration should only be used if you are sure that the content length matches
  //    the body length after external processing. Otherwise, it may cause vulnerability issues such as
  //    request smuggling. Thus, please use your own discretion when enabling this feature.
  //
  bool keep_content_length = 26;
}

// ExtProcHttpService is used for HTTP communication between the filter and the external processing service.
message ExtProcHttpService {
  // Sets the HTTP service which the external processing requests must be sent to.
  config.core.v3.HttpService http_service = 1;
}

// The MetadataOptions structure defines options for the sending and receiving of
// dynamic metadata. Specifically, which namespaces to send to the server, whether
// metadata returned by the server may be written, and how that metadata may be written.
message MetadataOptions {
  message MetadataNamespaces {
    // Specifies a list of metadata namespaces whose values, if present,
    // will be passed to the ``ext_proc`` service as an opaque ``protobuf::Struct``.
    repeated string untyped = 1;

Review comment (suggestion):
As setting this to true may incur data corruption/smuggling issues,  maybe we should: 1)  replace "needs" with "must" to make it stronger; 2)  explicitly mention the ext_proc server has to be in trusted domain.

Code after:
  //   Processing request modifiers are currently in alpha.
  //
  // [#extension-category: envoy.http.ext_proc.processing_request_modifiers]
  config.core.v3.TypedExtensionConfig processing_request_modifier = 25
      [(xds.annotations.v3.field_status).work_in_progress = true];

  // Decorator to introduce custom logic that runs after a message received from
  // the External Processor is processed, but before continuing filter chain iteration.
  //
  // .. note::
  //   Response processors are currently in alpha.
  //
  // [#extension-category: envoy.http.ext_proc.response_processors]
  config.core.v3.TypedExtensionConfig on_processing_response = 23
      [(xds.annotations.v3.field_status).work_in_progress = true];

  // Sets the HTTP status code that is returned to the client when the external processing server returns
  // an error, fails to respond, or cannot be reached.
  //
  // The default status is ``HTTP 500 Internal Server Error``.
  type.v3.HttpStatus status_on_error = 24;

  // If true, the filter will not remove the ``content-length`` header from the request/response after external processing.
  // It is typically used in
  // :ref:`FULL_DUPLEX_STREAMED <envoy_v3_api_enum_value_extensions.filters.http.ext_proc.v3.ProcessingMode.BodySendMode.FULL_DUPLEX_STREAMED>`
  // mode. If the original body has been modified, the external processing server needs to set the correct content-length header in HeaderMutation
  // that matches the modified body length.
  //
  // .. warning::
  //
  //    This configuration should only be used if you are sure that the content length matches
  //    the body length after external processing. Otherwise, it may cause vulnerability issues such as
  //    request smuggling. Thus, please use your own discretion when enabling this feature.
  //
  bool allow_content_length_header = 26;
}

// ExtProcHttpService is used for HTTP communication between the filter and the external processing service.
message ExtProcHttpService {
  // Sets the HTTP service which the external processing requests must be sent to.
  config.core.v3.HttpService http_service = 1;
}

// The MetadataOptions structure defines options for the sending and receiving of
// dynamic metadata. Specifically, which namespaces to send to the server, whether
// metadata returned by the server may be written, and how that metadata may be written.
message MetadataOptions {
  message MetadataNamespaces {
    // Specifies a list of metadata namespaces whose values, if present,
    // will be passed to the ``ext_proc`` service as an opaque ``protobuf::Struct``.
    repeated string untyped = 1;