[BUG] NPE/IndexOutOfBoundsException when request param is null or empty
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/client/ShenyuGrpcClient.java:75,81`
- description: When `parameterTypes` is blank, `param` can be null and execution reaches `client.call()`. Inside `call()`, line 75 `GsonUtils.getInstance().toObjectMap(requestJsons)` with null returns null; `JsonMessage.buildJsonMessageList(null)` NPEs. Even if it returns an empty list, line 81 `jsonRequestList.get(0)` throws `IndexOutOfBoundsException`.
- impact: gRPC methods with no parameter types crash with an uncaught exception instead of being proxied.
- suggested_fix: Handle null/blank `requestJsons` by building a single default empty DynamicMessage.
- confidence: High
- related_existing: none
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/client/ShenyuGrpcClient.java at lines 75 and 81, then trace how client.call() handles blank requestJsons and parameterTypes. Reproduce a gRPC call with no parameter types; done means it no longer throws NPE or IndexOutOfBoundsException and the method is proxied with an empty request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100