fix(admin): custom id empty value cause crash

CHANGELOG.md

@@ -111,6 +111,11 @@
   Docker containers if it was not cleanly stopped.
   [#10468](https://github.com/Kong/kong/pull/10468)
 
+#### Admin API
+
+- Fix an issue where empty value of URI argument `custom_id` crashes `/consumer`.
+  [#10475](https://github.com/Kong/kong/pull/10475)
+
 ### Changed
 
 #### Core

kong/api/routes/consumers.lua

@@ -10,11 +10,18 @@ return {
   ["/consumers"] = {
     GET = function(self, db, helpers, parent)
       local args = self.args.uri
+      local custom_id = args.custom_id
+
+      if custom_id and type(custom_id) ~= "string" or custom_id == "" then
+        return kong.response.exit(400, {
+          message = "custom_id must be an unempty string",
+        })
+      end
 
       -- Search by custom_id: /consumers?custom_id=xxx
-      if args.custom_id then
+      if custom_id then
         local opts = endpoints.extract_options(args, db.consumers.schema, "select")
-        local consumer, _, err_t = db.consumers:select_by_custom_id(args.custom_id, opts)
+        local consumer, _, err_t = db.consumers:select_by_custom_id(custom_id, opts)
         if err_t then
           return endpoints.handle_error(err_t)
         end

spec/02-integration/04-admin_api/03-consumers_routes_spec.lua

@@ -247,6 +247,14 @@ describe("Admin API (#" .. strategy .. "): ", function()
           pages[i] = json
         end
       end)
+      it("not crashed by empty custom_id #KAG-867", function()
+        local res = client:get("/consumers?custom_id=")
+        local body = assert.res_status(400, res)
+        assert(cjson.decode(body))
+        res = client:get("/consumers?custom_id")
+        body = assert.res_status(400, res)
+        assert(cjson.decode(body))
+      end)
       it("allows filtering by custom_id", function()
         local custom_id = gensym()
         local c = bp.consumers:insert({ custom_id = custom_id }, { nulls = true })