apache / apache/shenyu

[BUG] Non-atomic clear()+addAll() on shared TarsInvokePrxList races with concurrent readers

Open
#6,653 1 comment 0 reactions 0 assignees View on GitHub
plugin: tars priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/cache/ApplicationConfigCache.java:327-341`
- description: `refreshTarsInvokePrxList` calls `tarsInvokePrxList.getTarsInvokePrxList().clear()` followed later by `.addAll(...)`. The backing list is `CopyOnWriteArrayList`, so each call is individually atomic but the combined clear-then-addAll is NOT: between the two calls, concurrent request threads in `TarsPlugin` (line 82) observe `size()==0` and throw. `method`/`paramTypes`/`paramNames` are plain non-volatile fields mutated without synchronization.
- impact: During any selector upstream refresh, in-flight tars requests can fail with `IllegalArgumentException`/`NullPointerException`.
- suggested_fix: Build the new list locally then replace atomically (swap a whole new `TarsInvokePrxList` into the cache; make fields volatile).
- confidence: High
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with refreshTarsInvokePrxList in shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/cache/ApplicationConfigCache.java:327-341, then inspect concurrent reads in TarsPlugin at line 82. Done means refreshes replace the invocation list atomically, the method/parameter fields have safe visibility, and readers no longer observe an empty list or inconsistent values.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.