[BUG] Email alert reporting can fail with NPE for null or partial AlarmContent
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Current Behavior
`EmailAlertNotifyStrategy.buildAlertHtmlTemplate()` dereferences `alert` before checking whether it is null, and formats `dateCreated` without guarding against a null date.
Evidence:
`shenyu-alert/src/main/java/org/apache/shenyu/alert/strategy/EmailAlertNotifyStrategy.java:75-87`
```java
context.setVariable("content", alert.getContent());
SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
Date alertTime = alert.getDateCreated();
if (Objects.isNull(alert)) {
alertTime = new Date();
}
String alarmTime = simpleDateFormat.format(alertTime);
```
`AlertReportController` accepts the request body and dispatches it directly:
`shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AlertReportController.java:47-48`
```java
public ShenyuAdminResult reportAlert(@Valid @RequestBody final AlarmContent alarmContent) {
alertDispatchService.dispatchAlert(alarmContent);
```
A null/partial `AlarmContent`, or one with missing `dateCreated`, can cause a `NullPointerException` in the email alert strategy and make `/alert/report` fail with an internal error instead of a controlled validation failure or default timestamp.
### Expected Behavior
Alert reporting should validate missing alert content up front, and the email strategy should only dereference `alert` after the null check. Missing `dateCreated` should either be rejected as invalid input or default to the current time safely.
### Steps To Reproduce
1. Configure an email alert receiver.
2. POST `/alert/report` with a body that omits required alert fields or omits `dateCreated`.
3. The email template path dereferences `alert`/`alert.getDateCreated()` before validating the values.
### Suggested Fix
Move the null check before `alert.getContent()` and `alert.getDateCreated()`. Add bean validation constraints or explicit validation in `AlertReportController`/dispatch service for required `AlarmContent` fields.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.