apache / apache/shenyu

[BUG] Apache Dubbo namespace rewrite can corrupt registry addresses

Open
#6,516 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/shenyu/issues) and found no similar issues.

### Apache ShenYu Component

shenyu-plugin

### What happened

When a namespace header is present, `ApacheDubboConfigCache` rewrites the Dubbo registry address in `changeRegistryAddressNamespace(...)`:

```java
if (!currentRegistryConfig.getAddress().contains(Constants.NAMESPACE)) {
registryConfigNew.setAddress(currentRegistryConfig.getAddress() + "?" + Constants.NAMESPACE + "=" + namespace);
} else {
String newAddress = currentRegistryConfig.getAddress().substring(0, currentRegistryConfig.getAddress().indexOf(Constants.NAMESPACE) + 1) + Constants.NAMESPACE + "=" + namespace;
registryConfigNew.setAddress(newAddress);
}
```

`Constants.NAMESPACE` is the string `"namespace"`. If the existing address already contains a namespace query parameter, the substring keeps the first character of `namespace` and then appends `namespace` again.

For example:

```text
zookeeper://127.0.0.1:2181?namespace=old
```

becomes:

```text
zookeeper://127.0.0.1:2181?nnamespace=new
```

The rewritten registry address is malformed. If the original address has additional query parameters after `namespace`, they are also dropped by the same substring operation.

### Expected behavior

The namespace query parameter should be replaced without corrupting the parameter name and without discarding unrelated query parameters. Registry addresses should be parsed/updated as URIs or query parameter maps rather than by substring around the first occurrence of `"namespace"`.

### How to reproduce

1. Configure the Apache Dubbo plugin registry address with an existing namespace parameter, for example:

```text
zookeeper://127.0.0.1:2181?namespace=old
```

2. Send a Dubbo gateway request with the `namespace` header set to `new`.
3. `ApacheDubboConfigCache.changeRegistryAddressNamespace(...)` rewrites the address with `substring(0, indexOf("namespace") + 1) + "namespace=" + namespace`.
4. The resulting address contains `?nnamespace=new`, so the Dubbo reference uses an invalid registry address.

### Debug logs

_No response_

### Environment

Current `master` branch.

### Are you willing to submit a PR?

- [ ] Yes I am willing to submit a PR!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with ApacheDubboConfigCache.changeRegistryAddressNamespace(...) in the shenyu-plugin component and reproduce the rewrite using an address with an existing namespace and another query parameter. Update the behavior so the namespace is replaced without corrupting its name or dropping unrelated parameters, then verify the resulting registry address for both cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.