apache / apache/shenyu

[BUG] ScaleRuleServiceImpl.create caches a rule with a different ID than the one inserted (double UUID generation)

Open
#6,623 2 comments 0 reactions 1 assignee Claimed by @juicewcode View on GitHub
admin priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ScaleRuleServiceImpl.java:107-115`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/entity/ScaleRuleDO.java:212-216`
- description: In `create(...)`, `ScaleRuleDO.buildScaleRuleDO(scaleRuleDTO)` is called twice. `buildScaleRuleDO` generates a fresh `UUIDUtils.getInstance().generateShortUuid()` whenever the DTO id is blank (line 212-213). The first build (`scaleRuleDO`, line 107) gets UUID A and is inserted. The second build on line 112 runs on the same `scaleRuleDTO` whose `id` is STILL blank, so it generates a brand-new UUID B and stores that in `ScaleRuleCache`.
- impact: The cache holds a phantom rule (UUID B) that does not correspond to any DB row (UUID A). Subsequent `removeRulesFromCache(ids)` keyed by the real DB id will not touch the phantom; the scaler may operate on a rule that does not exist, or ignore the real one. Cache/DB divergence.
- suggested_fix: Reuse the inserted DO for the cache: `scaleRuleCache.addOrUpdateRuleToCache(scaleRuleDO);` (remove the second `buildScaleRuleDO` call). The same double-build pattern exists in `update` (line 128).
- confidence: High
- related_existing: none.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.