bhuvan-somisetty opened a new issue, #14164:
URL: https://github.com/apache/apisix/issues/14164
### Current Behavior
In `apisix/plugins/body-transformer.lua`, when `input_format` is `"json"`
(or inferred from `Content-Type: application/json`), the decoder decodes the
request or response body via `core.json.decode`:
```lua
local decoders = {
...
json = function(data)
return core.json.decode(data)
end,
...
}
```
When a client sends a valid JSON primitive (such as a number `123`, a string
`"hello"`, a boolean `true`/`false`, or `null`), `core.json.decode(data)`
returns a Lua primitive value (`number`, `string`, `boolean`, or `cjson.null`
userdata) instead of a table.
Because `out` is truthy, execution continues to:
```lua
out._ctx = nil
out._body = nil
out._escape_xml = nil
out._escape_json = nil
out._multipart = nil
setmetatable(out, {__index = {
_ctx = ctx,
_body = body,
_escape_xml = escape_xml,
_escape_json = escape_json,
_multipart = _multipart
}})
```
Attempting to index fields on a primitive (`out._ctx = nil`) causes a fatal
Lua runtime error:
```text
attempt to index local 'out' (a number value)
```
Similarly, `setmetatable` fails when passed a non-table value (`bad argument
#1 to 'setmetatable' (table expected, got number)`).
As a result, the Lua thread aborts with **HTTP 500 Internal Server Error**
instead of rejecting the invalid body structure with **HTTP 400 Bad Request**.
### Expected Behavior
The `body-transformer` plugin requires a JSON object (`{}`) or array (`[]`)
to populate the template context and attach helper metadata via `setmetatable`.
When `input_format` is `"json"` and the body decodes to a non-table value, the
decoder should reject it gracefully and return **HTTP 400 Bad Request** with
`request body decode: expected JSON object or array` rather than crashing with
HTTP 500.
### Error Logs
```text
2026/11/05 12:00:00 [error] 12345#12345: *1 lua entry thread aborted:
runtime error: /usr/local/apisix/apisix/plugins/body-transformer.lua:200:
attempt to index local 'out' (a number value)
stack traceback:
coroutine 0:
/usr/local/apisix/apisix/plugins/body-transformer.lua: in function
'transform'
/usr/local/apisix/apisix/plugins/body-transformer.lua: in function
'rewrite'
/usr/local/apisix/apisix/init.lua: in function 'http_rewrite_phase'
```
### Steps to Reproduce
1. Create a route with `body-transformer`:
```bash
curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
-d '{
"uri": "/echo",
"plugins": {
"body-transformer": {
"request": {
"input_format": "json",
"template": "hello"
}
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:1980": 1
}
}
}'
```
2. Send a request with a JSON number or string:
```bash
curl -X POST http://127.0.0.1:9080/echo \
-H "Content-Type: application/json" \
-d '123'
```
3. The request fails with HTTP 500 and the error log shows `attempt to index
local 'out' (a number value)`.
### Environment
- APISIX version (run `apisix version`): master (3.19.0)
- Operating system (run `uname -a`): Linux 5.15.0-generic x86_64
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
openresty/1.25.3.1
- etcd version, if relevant (run `curl
http://127.0.0.1:9090/v1/server_info`): 3.5.11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
