[BUG] ScaleRuleServiceImpl.create caches a rule with a different ID than the one inserted (double UUID generation)
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ScaleRuleServiceImpl.java:107-115`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/entity/ScaleRuleDO.java:212-216`
- description: In `create(...)`, `ScaleRuleDO.buildScaleRuleDO(scaleRuleDTO)` is called twice. `buildScaleRuleDO` generates a fresh `UUIDUtils.getInstance().generateShortUuid()` whenever the DTO id is blank (line 212-213). The first build (`scaleRuleDO`, line 107) gets UUID A and is inserted. The second build on line 112 runs on the same `scaleRuleDTO` whose `id` is STILL blank, so it generates a brand-new UUID B and stores that in `ScaleRuleCache`.
- impact: The cache holds a phantom rule (UUID B) that does not correspond to any DB row (UUID A). Subsequent `removeRulesFromCache(ids)` keyed by the real DB id will not touch the phantom; the scaler may operate on a rule that does not exist, or ignore the real one. Cache/DB divergence.
- suggested_fix: Reuse the inserted DO for the cache: `scaleRuleCache.addOrUpdateRuleToCache(scaleRuleDO);` (remove the second `buildScaleRuleDO` call). The same double-build pattern exists in `update` (line 128).
- confidence: High
- related_existing: none.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.