apache / apache/shenyu

[BUG] PageParameter pageSize null-guard checks the wrong variable (currentPage), NPE persists for non-null currentPage + null pageSize

Open Beginner friendly
#6,616 1 comment 0 reactions 0 assignees View on GitHub
admin priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/page/PageParameter.java:59`
- description: The `(Integer, Integer)` constructor guards `currentPage` for null before unboxing (line 58), but line 59 re-checks `Objects.isNull(currentPage)` instead of `Objects.isNull(pageSize)`: `this.pageSize = Objects.isNull(currentPage) || pageSize <= 0 ? DEFAULT_PAGE_SIZE : pageSize;`. When `currentPage` is non-null but `pageSize` is null, the short-circuit is false and `pageSize <= 0` unboxes a null `Integer`, throwing NPE.
- impact: Any caller constructing `new PageParameter(nonNullPage, null)` gets NPE instead of the intended default-page-size fallback. Currently masked because audited controllers declare `@NotNull` on `pageSize`, but the latent defect remains for any new paged endpoint that omits `@NotNull`.
- suggested_fix: Change line 59 to `Objects.isNull(pageSize) || pageSize <= 0 ? DEFAULT_PAGE_SIZE : pageSize;`.
- confidence: High
- related_existing: relates to #6463 but is NOT a dup — #6463 reported "NPE when pageSize omitted"; this finding reports that the closed fix guards the wrong variable, so the NPE still occurs whenever `currentPage` is present and `pageSize` is null.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Open shenyu-admin/src/main/java/org/apache/shenyu/admin/model/page/PageParameter.java at the two-Integer constructor around lines 58-59 and trace how its defaults are used. Reproduce construction with a non-null currentPage and null pageSize, then verify that null or non-positive values receive the default page size without changing current-page handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
86/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.