{"record":{"id":"9550d56510a44916","repo":"crowdsecurity/crowdsec","slug":"ref-cannot-be-empty","errorCode":null,"errorMessage":"ref cannot be empty","messagePattern":"ref cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":303,"sourceCode":"\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)\n\t\t}\n\t\tif authTokenValue == \"\" {\n\t\t\treturn errors.New(\"auth token is required but not provided\")\n\t\t}\n\n\t\treturn nil\n\t}\n}\n\nfunc (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {\n\tif ref == \"\" {\n\t\treturn errors.New(\"ref cannot be empty\")\n\t}\n\trv.logger.Debugf(\"loading schema for ref %s\", ref)\n\n\tif _, exists := rv.loaders[ref]; exists {\n\t\treturn fmt.Errorf(\"attempting to load a new schema for existing ref %s\", ref)\n\t}\n\n\toptions := opts.withDefaults()\n\tif err := options.OnRouteNotFound.validate(); err != nil {\n\t\treturn fmt.Errorf(\"on_route_not_found: %w\", err)\n\t}\n\tif err := options.OnMethodNotAllowed.validate(); err != nil {\n\t\treturn fmt.Errorf(\"on_method_not_allowed: %w\", err)\n\t}\n\tif err := options.OnUnsupportedSecurityScheme.validate(); err != nil {\n\t\treturn fmt.Errorf(\"on_unsupported_security_scheme: %w\", err)\n\t}\n","sourceCodeStart":285,"sourceCodeEnd":321,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L285-L321","documentation":"RequestValidator.LoadSchema loads an additional OpenAPI schema under a given ref. The ref is the key used to store and later look up the schema, so it must be a non-empty string; calling with an empty ref is rejected immediately.","triggerScenarios":"Calling LoadSchema(\"\", schema, opts) — programmatically or via loadAPISchema configuration that resolves to an empty ref (e.g. missing name/ref field in config or an empty map key).","commonSituations":"Config file entry for an extra schema missing its 'name'/'ref' key; ref computed from an env var or path that is empty; code refactoring that stopped populating the ref parameter.","solutions":["Provide a non-empty ref as the first argument to LoadSchema","Fix the appsec configuration so each extra schema entry has its name/ref key set","Validate the ref (strings.TrimSpace != \"\") before calling LoadSchema and fail with a clearer upstream error","Check env vars / templating used to build the ref aren't resolving to empty strings"],"exampleFix":"// before\nv.LoadSchema(cfg.RefName, schemaData, opts) // RefName == \"\"\n// after\nif cfg.RefName == \"\" { return fmt.Errorf(\"schema ref missing in config\") }\nv.LoadSchema(cfg.RefName, schemaData, opts)","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(ref) == \"\" { return errors.New(\"cannot load schema with empty ref\") }","typeGuard":null,"tryCatchPattern":"if err := rv.LoadSchema(ref, schema, opts); err != nil { if strings.Contains(err.Error(), \"ref cannot be empty\") { log.Error(\"schema entry missing ref/name in config\") } }","preventionTips":["Require a name/ref field for every extra-schema config entry and validate config at load time","Check templated/env-derived refs for empty resolution","Fail configuration load early with a clear message pointing at the config file"],"tags":["openapi","appsec","validation","config"],"backgroundTag":"empty-required-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}