apache / apache/shenyu

[BUG] Email alert reporting can fail with NPE for null or partial AlarmContent

Open
#6,446 2 comments 0 reactions 1 assignee Claimed by @wy471x View on GitHub
admin type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Current Behavior

`EmailAlertNotifyStrategy.buildAlertHtmlTemplate()` dereferences `alert` before checking whether it is null, and formats `dateCreated` without guarding against a null date.

Evidence:

`shenyu-alert/src/main/java/org/apache/shenyu/alert/strategy/EmailAlertNotifyStrategy.java:75-87`

```java
context.setVariable("content", alert.getContent());
SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
Date alertTime = alert.getDateCreated();
if (Objects.isNull(alert)) {
alertTime = new Date();
}
String alarmTime = simpleDateFormat.format(alertTime);
```

`AlertReportController` accepts the request body and dispatches it directly:

`shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AlertReportController.java:47-48`

```java
public ShenyuAdminResult reportAlert(@Valid @RequestBody final AlarmContent alarmContent) {
alertDispatchService.dispatchAlert(alarmContent);
```

A null/partial `AlarmContent`, or one with missing `dateCreated`, can cause a `NullPointerException` in the email alert strategy and make `/alert/report` fail with an internal error instead of a controlled validation failure or default timestamp.

### Expected Behavior

Alert reporting should validate missing alert content up front, and the email strategy should only dereference `alert` after the null check. Missing `dateCreated` should either be rejected as invalid input or default to the current time safely.

### Steps To Reproduce

1. Configure an email alert receiver.
2. POST `/alert/report` with a body that omits required alert fields or omits `dateCreated`.
3. The email template path dereferences `alert`/`alert.getDateCreated()` before validating the values.

### Suggested Fix

Move the null check before `alert.getContent()` and `alert.getDateCreated()`. Add bean validation constraints or explicit validation in `AlertReportController`/dispatch service for required `AlarmContent` fields.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.