From 77e9192d76f7a92256bd81415c442b9193787710 Mon Sep 17 00:00:00 2001 From: wy471x Date: Mon, 3 Aug 2026 22:35:48 +0800 Subject: [PATCH] fix: apply configured WAF statusCode to HTTP response instead of hardcoded 403 Co-Authored-By: Claude Opus 4.7 --- .../org/apache/shenyu/plugin/waf/WafPlugin.java | 5 +++-- .../apache/shenyu/plugin/waf/WafPluginTest.java | 14 +++++++++++++- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/shenyu-plugin/shenyu-plugin-waf/src/main/java/org/apache/shenyu/plugin/waf/WafPlugin.java b/shenyu-plugin/shenyu-plugin-waf/src/main/java/org/apache/shenyu/plugin/waf/WafPlugin.java index ec84dc9a8b62..e08563e5793a 100644 --- a/shenyu-plugin/shenyu-plugin-waf/src/main/java/org/apache/shenyu/plugin/waf/WafPlugin.java +++ b/shenyu-plugin/shenyu-plugin-waf/src/main/java/org/apache/shenyu/plugin/waf/WafPlugin.java @@ -65,8 +65,9 @@ protected Mono doExecute(final ServerWebExchange exchange, final ShenyuPlu return chain.execute(exchange); } if (WafEnum.REJECT.getName().equals(wafHandle.getPermission())) { - exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN); - Object error = ShenyuResultWrap.error(exchange, Integer.parseInt(wafHandle.getStatusCode()), Constants.REJECT_MSG, null); + int statusCode = Integer.parseInt(wafHandle.getStatusCode()); + exchange.getResponse().setRawStatusCode(statusCode); + Object error = ShenyuResultWrap.error(exchange, statusCode, Constants.REJECT_MSG, null); return WebFluxResultUtils.result(exchange, error); } return chain.execute(exchange); diff --git a/shenyu-plugin/shenyu-plugin-waf/src/test/java/org/apache/shenyu/plugin/waf/WafPluginTest.java b/shenyu-plugin/shenyu-plugin-waf/src/test/java/org/apache/shenyu/plugin/waf/WafPluginTest.java index 3bb68dbc754b..c83ae7137856 100644 --- a/shenyu-plugin/shenyu-plugin-waf/src/test/java/org/apache/shenyu/plugin/waf/WafPluginTest.java +++ b/shenyu-plugin/shenyu-plugin-waf/src/test/java/org/apache/shenyu/plugin/waf/WafPluginTest.java @@ -115,10 +115,22 @@ public void testWafPluginNotConfiguration() { public void testWafPluginReject() { ruleData.setId("waf"); ruleData.setSelectorId("waf"); - WafHandle handle = GsonUtils.getGson().fromJson("{\"permission\":\"reject\",\"statusCode\":\"0\"}", WafHandle.class); + WafHandle handle = GsonUtils.getGson().fromJson("{\"permission\":\"reject\",\"statusCode\":\"403\"}", WafHandle.class); WafPluginDataHandler.CACHED_HANDLE.get().cachedHandle(CacheKeyUtils.INST.getKey(ruleData), handle); Mono execute = wafPluginUnderTest.doExecute(exchange, chain, selectorData, ruleData); StepVerifier.create(execute).expectSubscription().verifyComplete(); + assertEquals(403, exchange.getResponse().getRawStatusCode()); + } + + @Test + public void testWafPluginRejectWithCustomStatusCode() { + ruleData.setId("waf"); + ruleData.setSelectorId("waf"); + WafHandle handle = GsonUtils.getGson().fromJson("{\"permission\":\"reject\",\"statusCode\":\"404\"}", WafHandle.class); + WafPluginDataHandler.CACHED_HANDLE.get().cachedHandle(CacheKeyUtils.INST.getKey(ruleData), handle); + Mono execute = wafPluginUnderTest.doExecute(exchange, chain, selectorData, ruleData); + StepVerifier.create(execute).expectSubscription().verifyComplete(); + assertEquals(404, exchange.getResponse().getRawStatusCode()); } @Test