apache / apache/shenyu

[BUG] Config import can create rows for a nonexistent namespace

Open
#6,481 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Current Behavior

Config import accepts any nonblank `namespace` request parameter and writes imported records with that value as `namespace_id`, even when the namespace does not exist.

`ConfigsExportImportController.importConfigs()` only checks that `namespace` is nonblank and that the file exists before calling `configsService.configsImport(namespace, ...)`.

Several import services then stamp the raw request value onto imported rows, for example:

- app auth import calls `appAuthDO.setNamespaceId(namespace)`
- metadata import calls `metaDataDTO.setNamespaceId(namespace)`
- discovery import calls `discoveryDTO.setNamespaceId(namespace)`

The affected tables store `namespace_id` as a plain column, so the database does not prevent orphaned rows.

### Expected Behavior

Config import should validate that the target namespace exists before importing namespace-scoped records.

### Steps to Reproduce

1. Prepare a valid config export file containing namespace-scoped data such as auth, metadata, or discovery records.
2. Call config import with a non-existing namespace id, for example:

```http
POST /configs/import?namespace=ghost-ns
```

3. The import can report success and create rows whose `namespace_id` is `ghost-ns`.

### Impact

Invalid imports can create orphaned records that are not attached to any existing namespace and may be hard to manage or clean up from the admin UI.

### Code Location

- `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ConfigsExportImportController.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/AppAuthServiceImpl.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryServiceImpl.java`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ConfigsExportImportController.java and trace configsService.configsImport(namespace, ...), then inspect the AppAuthServiceImpl, MetaDataServiceImpl, and DiscoveryServiceImpl locations listed. Reproduce the import with namespace=ghost-ns; done means a nonexistent namespace is rejected before namespace-scoped records are written.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.