[BUG] Hardcoded port 9527 without finally cleanup (TOCTOU BindException)
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
## Description
`new ServerSocket(9527)` on a fixed port, never closed in `finally`. If a `verify(...)` throws earlier, the socket leaks and the next run's `new ServerSocket(9527)` fails with `BindException`. Also fails if another process holds 9527.
## Location
```
shenyu-client/shenyu-client-core/src/test/java/org/apache/shenyu/client/core/disruptor/subcriber/ShenyuClientURIExecutorSubscriberTest.java:79
```
## Impact
Cross-run/cross-process flake.
## Suggested fix
Use `new ServerSocket(0)` (ephemeral), close in `try(…){}` or `@AfterEach`.
## Related existing issue(s)
None
_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Open shenyu-client/shenyu-client-core/src/test/java/org/apache/shenyu/client/core/disruptor/subcriber/ShenyuClientURIExecutorSubscriberTest.java around line 79 and inspect how the ServerSocket is used across the test. Run this test to reproduce or validate the cross-run failure. Done means the test no longer relies on fixed port 9527 and the socket is reliably closed when verification fails, with the test passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100