apache / apache/shenyu

[BUG] NPE/IndexOutOfBoundsException when request param is null or empty

Open Beginner friendly
#6,651 1 comment 0 reactions 0 assignees View on GitHub
plugin: grpc priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/client/ShenyuGrpcClient.java:75,81`
- description: When `parameterTypes` is blank, `param` can be null and execution reaches `client.call()`. Inside `call()`, line 75 `GsonUtils.getInstance().toObjectMap(requestJsons)` with null returns null; `JsonMessage.buildJsonMessageList(null)` NPEs. Even if it returns an empty list, line 81 `jsonRequestList.get(0)` throws `IndexOutOfBoundsException`.
- impact: gRPC methods with no parameter types crash with an uncaught exception instead of being proxied.
- suggested_fix: Handle null/blank `requestJsons` by building a single default empty DynamicMessage.
- confidence: High
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/client/ShenyuGrpcClient.java at lines 75 and 81, then trace how client.call() handles blank requestJsons and parameterTypes. Reproduce a gRPC call with no parameter types; done means it no longer throws NPE or IndexOutOfBoundsException and the method is proxied with an empty request.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
75/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.