From 34e60101290afffb52e89353d0b6c820c791ecec Mon Sep 17 00:00:00 2001
From: Abhishek Choudhary <shreemaan.abhishek@gmail.com>
Date: Mon, 13 Jul 2026 11:30:07 +0800
Subject: [PATCH 1/2] fix(opentelemetry): use oneOf for metadata
 additionalProperties value type

The resource and collector.request_headers metadata used an invalid
additionalProperties form: resource used a bare array of schemas and
request_headers used one_of, which is not a JSON Schema keyword. The
validator recognizes neither, so value-type validation was a no-op and
values of any type passed. Switch both to oneOf so non-scalar values are
rejected.
---
 apisix/plugins/opentelemetry.lua |  6 ++++--
 t/plugin/opentelemetry.t         | 35 ++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/apisix/plugins/opentelemetry.lua b/apisix/plugins/opentelemetry.lua
index 7ec44edd0047..c7125b56851d 100644
--- a/apisix/plugins/opentelemetry.lua
+++ b/apisix/plugins/opentelemetry.lua
@@ -69,7 +69,9 @@ local metadata_schema = {
         resource = {
             type = "object",
             description = "additional resource",
-            additionalProperties = {{type = "boolean"}, {type = "number"}, {type = "string"}},
+            additionalProperties = {
+                oneOf = {{type = "boolean"}, {type = "number"}, {type = "string"}},
+            },
         },
         collector = {
             type = "object",
@@ -81,7 +83,7 @@ local metadata_schema = {
                     type = "object",
                     description = "http headers",
                     additionalProperties = {
-                        one_of = {{type = "boolean"},{type = "number"}, {type = "string"}},
+                        oneOf = {{type = "boolean"}, {type = "number"}, {type = "string"}},
                    },
                 }
             },
diff --git a/t/plugin/opentelemetry.t b/t/plugin/opentelemetry.t
index 8287a99ea8cb..0297532c259d 100644
--- a/t/plugin/opentelemetry.t
+++ b/t/plugin/opentelemetry.t
@@ -734,3 +734,38 @@ plugins:
 grep apisix.phase.access ci/pod/otelcol-contrib/data-otlp.json | tail -n 1
 --- response_body eval
 qr/otel-meta-change-second/
+
+
+=== TEST 31: metadata_schema rejects non-scalar resource and collector.request_headers values
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local cases = {
+                {name = "object resource value",
+                 body = [[{"resource":{"service.name":{"nested":"table"}}}]]},
+                {name = "array resource value",
+                 body = [[{"resource":{"service.name":["a","b"]}}]]},
+                {name = "object request_headers value",
+                 body = [[{"collector":{"address":"127.0.0.1:4318","request_headers":{"Authorization":{"a":1}}}}]]},
+            }
+            for _, case in ipairs(cases) do
+                local code = t('/apisix/admin/plugin_metadata/opentelemetry',
+                               ngx.HTTP_PUT, case.body)
+                if code ~= 400 then
+                    ngx.say(case.name, ": expected 400, got ", code)
+                    return
+                end
+            end
+
+            -- scalars stay valid
+            local code = t('/apisix/admin/plugin_metadata/opentelemetry', ngx.HTTP_PUT,
+                [[{"resource":{"service.name":"APISIX","weight":1.5,"debug":true},]] ..
+                [["collector":{"address":"127.0.0.1:4318","request_headers":{"Authorization":"token"}}}]])
+            if code >= 300 then
+                ngx.say("valid metadata rejected, got ", code)
+                return
+            end
+            ngx.say("passed")
+        }
+    }

From b48f49d5d9ee6c8fcb5d9e948ec369a15de15e4f Mon Sep 17 00:00:00 2001
From: Abhishek Choudhary <shreemaan.abhishek@gmail.com>
Date: Mon, 13 Jul 2026 11:38:42 +0800
Subject: [PATCH 2/2] test(opentelemetry): reindex test file

---
 t/plugin/opentelemetry.t | 1 +
 1 file changed, 1 insertion(+)

diff --git a/t/plugin/opentelemetry.t b/t/plugin/opentelemetry.t
index 0297532c259d..b1700171f726 100644
--- a/t/plugin/opentelemetry.t
+++ b/t/plugin/opentelemetry.t
@@ -736,6 +736,7 @@ grep apisix.phase.access ci/pod/otelcol-contrib/data-otlp.json | tail -n 1
 qr/otel-meta-change-second/
 
 
+
 === TEST 31: metadata_schema rejects non-scalar resource and collector.request_headers values
 --- config
     location /t {