apache / apache/shenyu

[BUG] ModifyResponsePlugin unconditionally parses the response body as JSON, breaking non-JSON responses

Open Beginner friendly
#6,633 1 comment 0 reactions 0 assignees View on GitHub
plugin: modify-response priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: High
- Location:
`shenyu-plugin/shenyu-plugin-modify-response/src/main/java/org/apache/shenyu/plugin/modify/response/ModifyResponsePlugin.java:98-107` (`writeWith` always calls `modifyBody(bytes)`), `:160` (`modifyBody(String)` unconditionally calls `JsonPath.parse(jsonValue)`)
-
Description:
`writeWith` (line 98-107) always calls `modifyBody(bytes)`. `modifyBody(String)` (line 160) unconditionally executes `DocumentContext context = JsonPath.parse(jsonValue);` **before** and **regardless of** whether any `addBodyKeys`/`replaceBodyKeys`/`removeBodyKeys` are configured. The body-key branches at lines 161-169 are conditional, but the parse is not. If the matched route returns a non-JSON body (binary/image, HTML, plain text, CSS/JS, or an empty 204 body), `JsonPath.parse` throws `InvalidJsonException`. The catch at line 153-156 wraps it into a `ShenyuException`, producing a 500 instead of passing the response through.
-
Impact:
A header-only ModifyResponse rule (only `addHeaders`/`setHeaders`/`replaceHeaderKeys`/`removeHeaderKeys`/`statusCode`) applied to any non-JSON response corrupts valid responses with a 500.
-
Suggested fix:
In `modifyBody(String)`, return the body unchanged when `addBodyKeys`, `replaceBodyKeys`, and `removeBodyKeys` are all empty, skipping `JsonPath.parse` entirely.
-
Confidence: High
- Related existing: #6510 is the `replaceHeaderKeys` name-vs-value bug in `modifyResponseHeadersAndStatus`; this is a separate body-parsing bug.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-plugin/shenyu-plugin-modify-response/src/main/java/org/apache/shenyu/plugin/modify/response/ModifyResponsePlugin.java, especially writeWith at lines 98-107 and modifyBody(String) at lines 153-169. Trace how header-only rules reach JSON parsing, then verify that non-JSON, empty, and header-only responses pass through without an exception while body-key rules still work.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.