[Task] register the sensitive word plugin in the admin (db rows + rule form) and bound the inspected body

[HY-love-sleep]

Description

The sensitive word plugin is proposed in #7153: the plugin module, the starter, the rule handle
(SensitiveWordHandle) and PluginEnum.SENSITIVE_WORD are all in that PR, and the dictionary is read
from a redis set (default key shenyu:sensitive:words).

What #7153 deliberately does not contain is the registration data, so as of now the plugin cannot be
reached from the admin: there is no plugin row, no plugin_handle rows (neither the redis connection
nor the rule level settings), and no resource rows, which means no menu entry and no rule form.

This issue tracks that work. It will be done in a follow-up PR once #7153 is merged, so that the review
of the plugin itself stays focused on the plugin implementation.

TODO

db/init + db/upgrade

• db/init/mysql/schema.sql
• db/init/pg/create-table.sql
• db/init/oracle/schema.sql
• db/init/ob/schema.sql
• db/init/og/create-table.sql
• shenyu-admin/src/main/resources/sql-script/h2/schema.sql
• db/upgrade/2.7.1-upgrade-2.7.2-{mysql,pg,oracle,ob,og}.sql and the upgrade guide entry

for every dialect, the same set of rows:

• the plugin row: name sensitiveWord, role Ai, sort 197
• the plugin_handle rows: the redis connection (url / password / database) and the rule level
  settings (redisKey, refreshIntervalSeconds, failClosed)
• the resource rows: the menu entry and its children
• namespace_plugin_rel if the plugin has to be enabled for the default namespace

Console

• the rule form for the handle above, so that the dictionary key, the refresh interval and the fail
  strategy can be configured without editing sql

Body size

• a bound on the inspected body (maxBodySize), raised in the review of [type:feat] add the sensitive word plugin #7153: decide what happens
  when the body exceeds it (skip the scan and warn, or reject) and how that interacts with
  failClosed

Related

• [type:feat] add the sensitive word plugin #7153 - the plugin itself
• When the plugin config changes the redis connection is rebuilt and the previous lettuce connection is
  not released, because RedisConnectionFactory exposes no destroy() yet. This is pre-existing
  (AiTokenLimiterPluginHandler has the same shape) and will be a separate small PR against
  shenyu-infra/shenyu-infra-redis.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @HY-love-sleep:

• Title: [Task] register the sensitive word plugin in the admin (db rows + rule form) and bound the inspected body
• Link: [Task] register the sensitive word plugin in the admin (db rows + rule form) and bound the inspected body #7154

Please review when you have time. Thank you! 🙏

[HY-love-sleep]

The registration rows are in #7155:

• db/init (mysql, ob, pg, og, oracle and the h2 script the admin uses): the plugin, plugin_handle,
  resource, permission, shenyu_dict and namespace_plugin_rel rows;
• db/upgrade/2.7.1-upgrade-2.7.2-* plus the entry in the upgrade guide, for existing installations;
• a rule level words field, so a small list can be configured straight from the console form (the
  form is generated from the plugin_handle rows, so no shenyu-dashboard change is involved), and the
  rule level maxBodySize for the body bound, which is the other item this issue tracked.

Uploading a word list file from the console is deliberately not in #7155: it would need a redis
client inside shenyu-admin (the admin has none today), an upload endpoint with its own size limit,
encoding and audit rules, and a component in the separate shenyu-dashboard repository. Rather than
half doing it, it stays out — I can open a separate issue for it if it is wanted.

[HY-love-sleep]

Closing this: both parts landed.

• [type:feat] add the sensitive word plugin #7153 added the plugin itself (the automaton, the redis dictionary, the rule handle).
• [type:feat] register the sensitive word plugin in the admin #7155 registered it in the admin: the plugin, plugin_handle, resource, permission,
  shenyu_dict and namespace_plugin_rel rows for mysql, ob, pg, og, oracle and the h2 script the
  admin uses, the matching 2.7.1-upgrade-2.7.2-* scripts with their entry in the upgrade guide, the
  rule level words field so a small list can be configured straight from the console form, and the
  rule level maxBodySize bound (checked against the declared Content-Length before the body is
  buffered and once more after it has been read; an oversized request is passed through unscanned, or
  rejected when the rule is failClosed).

The plugin is therefore reachable and configurable from the console, which is what this issue was
about.

Not included, on purpose: uploading a word list file from the console. It needs a redis client
inside shenyu-admin (the admin has none today), an upload endpoint with its own size limit, encoding
and audit rules, and a component in the separate shenyu-dashboard repository. Redis remains the way
to feed a large dictionary and the module README documents it. If the upload is wanted, it deserves
its own issue rather than reopening this one.