apache / apache/shenyu

[BUG] BaseDataCache.removeSelectData/removeRuleData mutate live list in place while readers iterate unsynchronized (CME risk)

Open
#6,570 1 comment 0 reactions 0 assignees View on GitHub
plugin: divide priority: high type: performance
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

## Description
`removeSelectData`/`removeRuleData` mutate the live `ArrayList` in place under `synchronized(SELECTOR_MAP)`, while `AbstractShenyuPlugin.execute` streams the same list (`matchSelector`/`matchRule`) without synchronization. Concurrent `removeIf` (structural modification) on an `ArrayList` while another thread streams it can throw `ConcurrentModificationException` and/or skip/duplicate entries. Note `selectorAccept` (the update path) correctly replaces the reference atomically — only the remove path mutates in place.

## Location
```
shenyu-plugin-base/.../cache/BaseDataCache.java:133-140 (removeSelectData), 191-198 (removeRuleData)
readers at :173-174 (obtainSelectorData), AbstractShenyuPlugin.matchSelector/matchRule
```

## Impact
During config sync that deletes selectors/rules, concurrent requests matching that plugin can throw CME -> 500/exception and/or skip/duplicate entries. Both a correctness and a latency issue (errors under load during sync).

## Suggested fix
Make `removeSelectData`/`removeRuleData` replace the reference with a new immutable list (like `selectorAccept` already does), or use `CopyOnWriteArrayList`, so readers never observe in-place mutation.

## Related existing issue(s)
#6351 was a CME in a heartbeat subscriber (`ShenyuClientURIExecutorSubscriber`), a different class/path.

_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-plugin-base/.../cache/BaseDataCache.java by reading removeSelectData, removeRuleData, selectorAccept, and obtainSelectorData, then trace AbstractShenyuPlugin.matchSelector and matchRule. Compare the removal paths with the existing reference-replacement update path. Done means concurrent readers no longer observe in-place structural mutations during selector or rule removal, without the reported CME or skipped entries.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.