[BUG] WebSocket `enabled` hardcoded `true`, ignores `@ShenyuSpringWebSocketClient.enabled()`
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- Severity: High
- Location:
`shenyu-client/shenyu-client-websocket/shenyu-client-spring-websocket/src/main/java/org/apache/shenyu/client/spring/websocket/init/SpringWebSocketClientEventListener.java:229`
-
Description:
`buildMetaDataDTO` builds the `MetaDataRegisterDTO` with `.enabled(true)` literally. The annotation declares `boolean enabled() default true;` (`ShenyuSpringWebSocketClient.java:68`) and is meant to allow disabling a route. Every other client honors the field — SOFA does `.enabled(shenyuSofaClient.enabled())` (`SofaServiceEventListener.java:170`), Tars `.enabled(shenyuTarsClient.enabled())` (`TarsServiceBeanEventListener.java:191`), MCP `metaDataRegisterDTO.setEnabled(shenyuMcpTool.getEnable())` (`McpServiceEventListener.java:370`). Only WebSocket ignores it.
-
Impact:
`@ShenyuSpringWebSocketClient(enabled = false)` to take a websocket endpoint offline still registers the metadata as enabled; the route stays live — opt-out silently broken (availability/security).
-
Suggested fix:
Replace `.enabled(true)` with `.enabled(webSocketClient.enabled())`.
-
Confidence: High
- Related existing: none
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at shenyu-client/shenyu-client-websocket/shenyu-client-spring-websocket/src/main/java/org/apache/shenyu/client/spring/websocket/init/SpringWebSocketClientEventListener.java:229 and inspect the enabled attribute in ShenyuSpringWebSocketClient.java:68. Compare the WebSocket metadata registration with the SOFA and Tars listeners, then verify that enabled=false registers the route as disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100