This is an automated email from the ASF dual-hosted git repository.
nic-6443 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 9aee46aaa fix(workflow): reject invalid case expressions and missing
action conf (#13862)
9aee46aaa is described below
commit 9aee46aaabb6848305034716998dadf9ed11e488
Author: Arjen10 <[email protected]>
AuthorDate: Thu Sep 10 14:00:28 2026 +0800
fix(workflow): reject invalid case expressions and missing action conf
(#13862)
---
apisix/plugins/workflow.lua | 11 +-
t/plugin/workflow.t | 2 +-
t/plugin/workflow2.t | 310 ++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 320 insertions(+), 3 deletions(-)
diff --git a/apisix/plugins/workflow.lua b/apisix/plugins/workflow.lua
index aa5143a43..ce9a1262e 100644
--- a/apisix/plugins/workflow.lua
+++ b/apisix/plugins/workflow.lua
@@ -45,9 +45,16 @@ local schema = {
},
actions = {
type = "array",
+ minItems = 1,
+ maxItems = 1,
items = {
type = "array",
- minItems = 1
+ minItems = 2,
+ maxItems = 2,
+ items = {
+ { type = "string" },
+ { type = "object" },
+ }
}
}
},
@@ -122,7 +129,7 @@ function _M.check_schema(conf)
for idx, rule in ipairs(conf.rules) do
if rule.case then
local expr, err = expr.new(rule.case)
- if not ok then
+ if not expr then
return false, "failed to validate the 'case' expression: " ..
err
end
local mt = getmetatable(rule)
diff --git a/t/plugin/workflow.t b/t/plugin/workflow.t
index a8e8e2d57..302d0b0d5 100644
--- a/t/plugin/workflow.t
+++ b/t/plugin/workflow.t
@@ -161,7 +161,7 @@ __DATA__
--- response_body
done
property "rules" validation failed: failed to validate item 1: property
"actions" is required
-property "rules" validation failed: failed to validate item 1: property
"actions" validation failed: failed to validate item 1: expect array to have at
least 1 items
+property "rules" validation failed: failed to validate item 1: property
"actions" validation failed: failed to validate item 1: expect array to have at
least 2 items
failed to validate the 'return' action: property "code" is required
failed to validate the 'return' action: property "code" validation failed:
wrong type: expected integer, got string
property "rules" validation failed: failed to validate item 1: property "case"
validation failed: expect array to have at least 1 items
diff --git a/t/plugin/workflow2.t b/t/plugin/workflow2.t
index 686e4bb13..25cbb4da3 100644
--- a/t/plugin/workflow2.t
+++ b/t/plugin/workflow2.t
@@ -316,3 +316,313 @@ passed
--- error_code: 400
--- response_body
{"error_msg":"failed to check the configuration of plugin workflow err:
property \"rules\" is required"}
+
+
+
+=== TEST 9: reject missing action conf
+--- config
+ location /t {
+ content_by_lua_block {
+ local json = require("toolkit.json")
+ local t = require("lib.test_admin").test
+ local data = {
+ uri = "/*",
+ plugins = {
+ workflow = {
+ rules = {
+ {
+ case = {
+ {"uri", "==", "/hello"}
+ },
+ actions = {
+ {
+ "return"
+ }
+ }
+ }
+ }
+ }
+ },
+ upstream = {
+ nodes = {
+ ["127.0.0.1:1980"] = 1
+ },
+ type = "roundrobin"
+ }
+ }
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ json.encode(data)
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body
+{"error_msg":"failed to check the configuration of plugin workflow err:
property \"rules\" validation failed: failed to validate item 1: property
\"actions\" validation failed: failed to validate item 1: expect array to have
at least 2 items"}
+
+
+
+=== TEST 10: reject empty actions
+--- config
+ location /t {
+ content_by_lua_block {
+ local json = require("toolkit.json")
+ local t = require("lib.test_admin").test
+ local data = {
+ uri = "/*",
+ plugins = {
+ workflow = {
+ rules = {
+ {
+ case = {
+ {"uri", "==", "/hello"}
+ },
+ actions = {
+ }
+ }
+ }
+ }
+ },
+ upstream = {
+ nodes = {
+ ["127.0.0.1:1980"] = 1
+ },
+ type = "roundrobin"
+ }
+ }
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ json.encode(data)
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body
+{"error_msg":"failed to check the configuration of plugin workflow err:
property \"rules\" validation failed: failed to validate item 1: property
\"actions\" validation failed: expect array to have at least 1 items"}
+
+
+
+=== TEST 11: reject non-string action name
+--- config
+ location /t {
+ content_by_lua_block {
+ local json = require("toolkit.json")
+ local t = require("lib.test_admin").test
+ local data = {
+ uri = "/*",
+ plugins = {
+ workflow = {
+ rules = {
+ {
+ case = {
+ {"uri", "==", "/hello"}
+ },
+ actions = {
+ {
+ true,
+ {
+ code = 403
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ upstream = {
+ nodes = {
+ ["127.0.0.1:1980"] = 1
+ },
+ type = "roundrobin"
+ }
+ }
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ json.encode(data)
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body
+{"error_msg":"failed to check the configuration of plugin workflow err:
property \"rules\" validation failed: failed to validate item 1: property
\"actions\" validation failed: failed to validate item 1: failed to validate
item 1: wrong type: expected string, got boolean"}
+
+
+
+=== TEST 12: reject invalid case expression
+--- config
+ location /t {
+ content_by_lua_block {
+ local json = require("toolkit.json")
+ local t = require("lib.test_admin").test
+ local data = {
+ uri = "/*",
+ plugins = {
+ workflow = {
+ rules = {
+ {
+ case = {
+ {"uri", "=", "/hello"}
+ },
+ actions = {
+ {
+ "return",
+ {
+ code = 403
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ upstream = {
+ nodes = {
+ ["127.0.0.1:1980"] = 1
+ },
+ type = "roundrobin"
+ }
+ }
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ json.encode(data)
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body
+{"error_msg":"failed to check the configuration of plugin workflow err: failed
to validate the 'case' expression: invalid operator '='"}
+
+
+
+=== TEST 13: reject more than one action
+--- config
+ location /t {
+ content_by_lua_block {
+ local json = require("toolkit.json")
+ local t = require("lib.test_admin").test
+ local data = {
+ uri = "/*",
+ plugins = {
+ workflow = {
+ rules = {
+ {
+ case = {
+ {"uri", "==", "/hello"}
+ },
+ actions = {
+ {
+ "return",
+ {
+ code = 403
+ }
+ },
+ {
+ "return",
+ {
+ code = 404
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ upstream = {
+ nodes = {
+ ["127.0.0.1:1980"] = 1
+ },
+ type = "roundrobin"
+ }
+ }
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ json.encode(data)
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body
+{"error_msg":"failed to check the configuration of plugin workflow err:
property \"rules\" validation failed: failed to validate item 1: property
\"actions\" validation failed: expect array to have at most 1 items"}
+
+
+
+=== TEST 14: reject action with more than two items
+--- config
+ location /t {
+ content_by_lua_block {
+ local json = require("toolkit.json")
+ local t = require("lib.test_admin").test
+ local data = {
+ uri = "/*",
+ plugins = {
+ workflow = {
+ rules = {
+ {
+ case = {
+ {"uri", "==", "/hello"}
+ },
+ actions = {
+ {
+ "return",
+ {
+ code = 403
+ },
+ "extra"
+ }
+ }
+ }
+ }
+ }
+ },
+ upstream = {
+ nodes = {
+ ["127.0.0.1:1980"] = 1
+ },
+ type = "roundrobin"
+ }
+ }
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ json.encode(data)
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+
+ ngx.print(body)
+ }
+ }
+--- error_code: 400
+--- response_body
+{"error_msg":"failed to check the configuration of plugin workflow err:
property \"rules\" validation failed: failed to validate item 1: property
\"actions\" validation failed: failed to validate item 1: expect array to have
at most 2 items"}
