[BUG] Non-atomic clear()+addAll() on shared TarsInvokePrxList races with concurrent readers
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/cache/ApplicationConfigCache.java:327-341`
- description: `refreshTarsInvokePrxList` calls `tarsInvokePrxList.getTarsInvokePrxList().clear()` followed later by `.addAll(...)`. The backing list is `CopyOnWriteArrayList`, so each call is individually atomic but the combined clear-then-addAll is NOT: between the two calls, concurrent request threads in `TarsPlugin` (line 82) observe `size()==0` and throw. `method`/`paramTypes`/`paramNames` are plain non-volatile fields mutated without synchronization.
- impact: During any selector upstream refresh, in-flight tars requests can fail with `IllegalArgumentException`/`NullPointerException`.
- suggested_fix: Build the new list locally then replace atomically (swap a whole new `TarsInvokePrxList` into the cache; make fields volatile).
- confidence: High
- related_existing: none
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with refreshTarsInvokePrxList in shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/cache/ApplicationConfigCache.java:327-341, then inspect concurrent reads in TarsPlugin at line 82. Done means refreshes replace the invocation list atomically, the method/parameter fields have safe visibility, and readers no longer observe an empty list or inconsistent values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 70/100