[BUG] PageParameter pageSize null-guard checks the wrong variable (currentPage), NPE persists for non-null currentPage + null pageSize
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/page/PageParameter.java:59`
- description: The `(Integer, Integer)` constructor guards `currentPage` for null before unboxing (line 58), but line 59 re-checks `Objects.isNull(currentPage)` instead of `Objects.isNull(pageSize)`: `this.pageSize = Objects.isNull(currentPage) || pageSize <= 0 ? DEFAULT_PAGE_SIZE : pageSize;`. When `currentPage` is non-null but `pageSize` is null, the short-circuit is false and `pageSize <= 0` unboxes a null `Integer`, throwing NPE.
- impact: Any caller constructing `new PageParameter(nonNullPage, null)` gets NPE instead of the intended default-page-size fallback. Currently masked because audited controllers declare `@NotNull` on `pageSize`, but the latent defect remains for any new paged endpoint that omits `@NotNull`.
- suggested_fix: Change line 59 to `Objects.isNull(pageSize) || pageSize <= 0 ? DEFAULT_PAGE_SIZE : pageSize;`.
- confidence: High
- related_existing: relates to #6463 but is NOT a dup — #6463 reported "NPE when pageSize omitted"; this finding reports that the closed fix guards the wrong variable, so the NPE still occurs whenever `currentPage` is present and `pageSize` is null.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Open shenyu-admin/src/main/java/org/apache/shenyu/admin/model/page/PageParameter.java at the two-Integer constructor around lines 58-59 and trace how its defaults are used. Reproduce construction with a non-null currentPage and null pageSize, then verify that null or non-positive values receive the default page size without changing current-page handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 86/100