AlinsRan commented on code in PR #13886:
URL: https://github.com/apache/apisix/pull/13886#discussion_r3878222564
##########
apisix/admin/config_validate.lua:
##########
@@ -125,10 +125,31 @@ function _M.validate_configuration(req_body,
collect_all_errors)
local is_valid = true
local validation_results = {}
+ if type(req_body) ~= "table" then
+ local err_msg = "invalid request body: it should be an object"
+ if not collect_all_errors then
+ return false, err_msg
+ end
+ return false, {{resource_type = "", error = err_msg}}
+ end
+
for key, conf_version_key in pairs(ALL_RESOURCE_KEYS) do
local items = req_body[key]
local resource = resources[key] or {}
+ -- a client can send any JSON/YAML value here; `#items` and `ipairs`
+ -- raise a Lua error on a scalar, and admin/standalone.lua calls this
+ -- without a pcall
+ if items ~= nil and type(items) ~= "table" then
+ local err_msg = key .. " must be an array, got " .. type(items)
+ if not collect_all_errors then
+ return false, err_msg
+ end
+ is_valid = false
+ table_insert(validation_results, {resource_type = key, error =
err_msg})
+ items = nil
+ end
Review Comment:
Done — the shape check is now a schema generated from the resource list,
rather than hand-rolled type tests:
```lua
for key, conf_version_key in pairs(ALL_RESOURCE_KEYS) do
properties[key] = {type = "array", items = {type = "object"}}
properties[conf_version_key] = {type = "integer", minimum = 0}
end
config_schema = {type = "object", properties = properties}
```
`validate_configuration()` runs `core.schema.check(config_schema, req_body)`
before anything iterates the body. That also covers the cases membphis raised:
a top-level array, an object used as a resource list, and scalar or null
elements. Covered by t/admin/config-validate.t TEST 20-23 and
t/admin/standalone.t TEST 21-23.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
