[BUG] RequestPlugin resp unique-headers condition checks the wrong strategy field
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High
- files: `shenyu-plugin/shenyu-plugin-request/src/main/java/org/apache/shenyu/plugin/request/RequestPlugin.java:70`
- description: The second `if` block (lines 70-73) is intended to set up response header dedup but its guard condition checks `requestHandle.getRequestHeaderUniqueStrategy()` (the *request* strategy) instead of `requestHandle.getRespHeaderUniqueStrategy()` (the *response* strategy). Copy-paste error from the block above (lines 66-69). If request strategy is non-null (default) but response strategy is explicitly null, `exchange.getAttributes().put(..., null)` on a ConcurrentHashMap-backed map throws NPE.
- impact: (a) Resp dedup silently never applied when request strategy is null. (b) NPE when response strategy is null but request strategy is non-null.
- suggested_fix: Change line 70 to `Objects.nonNull(requestHandle.getRespHeaderUniqueStrategy()) && StringUtils.isNotEmpty(requestHandle.getRespUniqueHeaders())`.
- confidence: High
- related_existing: none — #6360 is about add* overwriting; #6507 is about partial config. This is a distinct copy-paste bug.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in shenyu-plugin/shenyu-plugin-request/src/main/java/org/apache/shenyu/plugin/request/RequestPlugin.java around lines 66-73 and compare the request and response strategy guards. Verify the response branch uses the response strategy and add focused coverage for both null-strategy cases. Done means response deduplication follows response settings without the reported ConcurrentHashMap NPE.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100