{"record":{"id":"c39fa81925f6e3b4","repo":"crowdsecurity/crowdsec","slug":"invalid-schema-name","errorCode":null,"errorMessage":"invalid schema name","messagePattern":"invalid schema name","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":18,"sourceCode":"package apivalidation\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"strings\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers\"\n\tlegacyrouter \"github.com/getkin/kin-openapi/routers/legacy\"\n\tlog \"github.com/sirupsen/logrus\"\n)\n\nvar (\n\tErrInvalidSchemaName = errors.New(\"invalid schema name\")\n)\n\n// Policy controls what the validator does when it encounters a condition it\n// cannot fully validate (unknown route, method not allowed for a matched\n// path, security scheme type the WAF cannot enforce).\ntype Policy string\n\nconst (\n\t// PolicyDrop treats the condition as a validation failure.\n\tPolicyDrop Policy = \"drop\"\n\t// PolicyIgnore lets the request through as if the condition had passed.\n\tPolicyIgnore Policy = \"ignore\"\n)\n\nfunc (p Policy) validate() error {\n\tswitch p {\n\tcase PolicyDrop, PolicyIgnore:\n\t\treturn nil","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L1-L36","documentation":"ErrInvalidSchemaName is a sentinel error returned by the AppSec API validator when a request references an OpenAPI schema ref that is not present in the loaded openAPISchemas map (no schema was loaded for that ref). Callers can match it with errors.Is to distinguish 'unknown schema' from a validation failure.","triggerScenarios":"ValidateRequest resolving a schema ref (e.g. requestBody/parameter $ref or operationId mapping) when rv.openAPISchemas[ref] does not exist, reported as fmt.Errorf(\"%w: no schema loaded for ref %s\", ErrInvalidSchemaName, ref).","commonSituations":"AppSec config pointing at an operationId/schema name that does not exist in the loaded OpenAPI spec; typo in the ref name; spec file failed to load partially so schemas were never registered; renamed schema after an upgrade.","solutions":["Fix the ref/operationId in the AppSec config to match a schema present in the OpenAPI spec","Verify the OpenAPI spec file loads correctly and contains the referenced schema","Check logs for earlier spec-loading errors and correct the spec path/syntax","Match with errors.Is(err, api_validation.ErrInvalidSchemaName) in code to handle this case specifically"],"exampleFix":"// before (appsec config)\nvalidate:\n  schema: \"MyRequestSchema\"  # does not exist in the spec\n// after\nvalidate:\n  schema: \"CreateAlertRequest\"  # matches a schema defined in the loaded spec","handlingStrategy":"try-catch","validationCode":"// verify the schema ref exists in the loaded spec at startup\nif _, ok := schemas[refName]; !ok {\n    return fmt.Errorf(\"schema %q not found in loaded OpenAPI spec\", refName)\n}","typeGuard":null,"tryCatchPattern":"err := validator.ValidateRequest(req)\nif errors.Is(err, api_validation.ErrInvalidSchemaName) {\n    log.Errorf(\"config references unknown schema: %v\", err)\n    return\n}","preventionTips":["Validate AppSec config schema names against the spec at startup (fail fast)","Keep schema names in sync after spec upgrades/renames","Watch spec-load logs: a failed load silently empties the schema map"],"tags":["appsec","openapi","schema","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}