apache / apache/shenyu

[BUG] API doc registration throws NPE when eventType is missing

Open
#6,469 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Current Behavior

`/shenyu-client/register-apiDoc` accepts `ApiDocRegisterDTO` without validating that `eventType` is present. The DTO field is nullable, but `RegisterApiDocServiceImpl.registerApiDocument()` calls `apiDocRegisterDTO.getEventType().equals(...)` directly:

```java
if (apiDocRegisterDTO.getEventType().equals(EventType.REGISTER)) {
...
} else if (apiDocRegisterDTO.getEventType().equals(EventType.OFFLINE)) {
...
}
```

If a client sends an API doc registration payload without `eventType`, the admin side can throw `NullPointerException` while processing the registration event.

### Expected Behavior

The register API should either reject the request with a clear validation error when `eventType` is missing, or handle a missing/unknown event type without throwing an internal exception.

### Steps to Reproduce

1. Send a request to the API doc registration endpoint without `eventType`, for example:

```http
POST /shenyu-client/register-apiDoc
Content-Type: application/json

{
"rpcType": "http",
"contextPath": "/demo",
"apiPath": "/demo/test"
}
```

2. The controller publishes the DTO without validation.
3. The API doc registration service dereferences `getEventType()` and can throw `NullPointerException`.

### Code Location

- `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ShenyuClientHttpRegistryController.java`
- `registerApiDoc()` publishes the request body directly.
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/manager/impl/RegisterApiDocServiceImpl.java`
- `registerApiDocument()` calls `apiDocRegisterDTO.getEventType().equals(...)`.
- `shenyu-register-center/shenyu-register-common/src/main/java/org/apache/shenyu/register/common/dto/ApiDocRegisterDTO.java`
- `eventType` is nullable and has no validation annotation.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at registerApiDoc() in ShenyuClientHttpRegistryController.java and trace the DTO into registerApiDocument() in RegisterApiDocServiceImpl.java; then inspect eventType in ApiDocRegisterDTO.java. Reproduce the POST without eventType and verify the endpoint returns a clear validation error or safely handles the missing or unknown value without a NullPointerException.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.