Arjen10 opened a new issue, #13910:
URL: https://github.com/apache/apisix/issues/13910
### Current Behavior
workflow plugin check_schema has two validation bugs.
1、after expr.new(rule.case), the code inspects the wrong variable:
```lua
local expr, err = expr.new(rule.case)
-- still the schema-check result, which is already true
if not ok then
return false, "failed to validate the 'case' expression: " .. err
end
```
2、action conf is optional in the JSON schema (actions items are arrays with
minItems = 1, no requirement that index 2 exists). check_schema then does:
```lua
action[2]["_vid"] = idx
```
when the action is just ["return"] with no conf table, this indexes nil and
the Admin API returns HTTP 500 instead of a validation error.
### Expected Behavior
1、Invalid case expressions (expr.new failure) must be rejected at
schema-check time with failed to validate the 'case' expression: ...
2、Missing action configuration must be rejected with failed to validate the
'<action>' action: configuration is required and must not 500 the Admin API.
### Error Logs
```txt
2026/09/02 08:20:14 [error] 49#49: *57321127 lua entry thread aborted:
runtime error: /usr/local/apisix/apisix/plugins/workflow.lua:144: attempt to
index a nil value
stack traceback:
coroutine 0:
/usr/local/apisix/apisix/plugins/workflow.lua: in function
'check_schema'
/usr/local/apisix/apisix/plugin.lua:992: in function
'check_single_plugin_schema'
/usr/local/apisix/apisix/plugin.lua:1198: in function 'schema_plugin'
/usr/local/apisix/apisix/admin/routes.lua:130: in function 'checker'
/usr/local/apisix/apisix/admin/resource.lua:126: in function
'check_conf'
/usr/local/apisix/apisix/admin/resource.lua:256: in function
</usr/local/apisix/apisix/admin/resource.lua:243>
/usr/local/apisix/apisix/admin/init.lua:235: in function 'handler'
/usr/local/apisix//deps/share/lua/5.1/resty/radixtree.lua:1013: in
function 'dispatch'
/usr/local/apisix/apisix/init.lua:1203: in function 'http_admin'
```
### Steps to Reproduce
```curl
curl --location --request PUT
'http://172.18.0.21:9180/apisix/admin/routes/test' \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: ••••••' \
--data '{
"uri": "/fake",
"name": "xxx",
"plugins": {
"workflow": {
"rules": [
{
"case": [
[
"uri",
"bad_case_????!!!!",
"/hello"
]
],
"actions": [
[
"return"
]
]
}
]
}
},
"upstream": {
"type": "roundrobin",
"scheme": "https",
"pass_host": "node",
"nodes": {
"xxx:6443": 1
}
}
}'
```
### Environment
- APISIX version (run `apisix version`): 3.18
- Operating system (run `uname -a`):
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
- etcd version, if relevant (run `curl
http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
