[BUG] Invalid discoveryHandlerId can persist broken discovery upstream rows
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Current Behavior
`/discovery-upstream` accepts `DiscoveryUpstreamDTO.discoveryHandlerId` with only `@NotBlank` validation. It does not verify that the referenced discovery handler exists.
The create path inserts the row first and then refreshes discovery data:
```java
discoveryUpstreamMapper.insert(discoveryUpstreamDO);
fetchAll(discoveryUpstreamDTO.getDiscoveryHandlerId());
```
`fetchAll(...)` then dereferences the handler returned by `discoveryHandlerMapper.selectById(discoveryHandlerId)` without a null check:
```java
DiscoveryHandlerDO discoveryHandlerDO = discoveryHandlerMapper.selectById(discoveryHandlerId);
...
SelectorDO selectorDO = selectorMapper.selectByDiscoveryHandlerId(discoveryHandlerDO.getId());
...
DiscoveryDO discoveryDO = discoveryMapper.selectById(discoveryHandlerDO.getDiscoveryId());
```
The `discovery_upstream` schema has a unique key on `(discovery_handler_id, upstream_url)`, but no foreign key to `discovery_handler`. Therefore a request with a non-existent `discoveryHandlerId` can insert an orphan upstream row and then fail with a server error during refresh.
### Expected Behavior
`discoveryHandlerId` should be validated before insert/update, or `fetchAll(...)` should fail gracefully before data is persisted.
If the handler does not exist, the API should return a validation error and should not leave a broken `discovery_upstream` row behind.
### Steps To Reproduce
1. Call `POST /discovery-upstream` with a valid `namespaceId`, valid URL/status/weight fields, but a `discoveryHandlerId` that does not exist.
2. The DTO passes validation because `discoveryHandlerId` is nonblank.
3. `DiscoveryUpstreamServiceImpl#create(...)` inserts the row.
4. `fetchAll(...)` dereferences a null `DiscoveryHandlerDO`, returning a 500 and leaving inconsistent data.
### Environment
```markdown
ShenYu version(s): current master
```
### Debug logs
_No response_
### Anything else?
Relevant current-master files:
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/DiscoveryUpstreamDTO.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/DiscoveryUpstreamController.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryUpstreamServiceImpl.java`
- `db/init/mysql/schema.sql`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.