Merge remote-tracking branch 'main/main'

bouncer.go

@@ -733,7 +733,17 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string, data []byte) ([]byte, err
 // a 403. This mirrors the reference lua-cs-bouncer behavior, which refuses to
 // read the body of an HTTP/2+ request that has no Content-Length.
 func isBodyUnreadable(httpReq *http.Request) bool {
-	return httpReq.Body != nil && httpReq.ProtoMajor >= 2 && httpReq.ContentLength < 0
+	return httpReq.Body != nil && httpReq.Body != http.NoBody && httpReq.ProtoMajor >= 2 && httpReq.ContentLength < 0
+}
+
+// isMethodWithBody used only when isBodyUnreadable returns true but the request method can't have body.
+func isMethodWithBody(method string) bool {
+	switch method {
+	case http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete:
+		return true
+	default:
+		return false
+	}
 }
 
 func appsecQuery(bouncer *Bouncer, ip string, httpReq *http.Request) error {
@@ -745,8 +755,7 @@ func appsecQuery(bouncer *Bouncer, ip string, httpReq *http.Request) error {
 	var req *http.Request
 	switch {
 	case isBodyUnreadable(httpReq):
-		if bouncer.appsecUnreadableBodyBlock {
-			// The caller (handleNextServeHTTP) logs this returned error with the IP.
+		if bouncer.appsecUnreadableBodyBlock && isMethodWithBody(httpReq.Method) {
 			return errors.New("appsecQuery:unreadableBody dropped")
 		}
 		req, _ = http.NewRequest(http.MethodGet, routeURL.String(), nil)