apache / apache/shenyu

[BUG] WebSocket `enabled` hardcoded `true`, ignores `@ShenyuSpringWebSocketClient.enabled()`

Open Beginner friendly
#6,665 1 comment 0 reactions 0 assignees View on GitHub
client: register priority: high type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: High
- Location:
`shenyu-client/shenyu-client-websocket/shenyu-client-spring-websocket/src/main/java/org/apache/shenyu/client/spring/websocket/init/SpringWebSocketClientEventListener.java:229`
-
Description:
`buildMetaDataDTO` builds the `MetaDataRegisterDTO` with `.enabled(true)` literally. The annotation declares `boolean enabled() default true;` (`ShenyuSpringWebSocketClient.java:68`) and is meant to allow disabling a route. Every other client honors the field — SOFA does `.enabled(shenyuSofaClient.enabled())` (`SofaServiceEventListener.java:170`), Tars `.enabled(shenyuTarsClient.enabled())` (`TarsServiceBeanEventListener.java:191`), MCP `metaDataRegisterDTO.setEnabled(shenyuMcpTool.getEnable())` (`McpServiceEventListener.java:370`). Only WebSocket ignores it.
-
Impact:
`@ShenyuSpringWebSocketClient(enabled = false)` to take a websocket endpoint offline still registers the metadata as enabled; the route stays live — opt-out silently broken (availability/security).
-
Suggested fix:
Replace `.enabled(true)` with `.enabled(webSocketClient.enabled())`.
-
Confidence: High
- Related existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at shenyu-client/shenyu-client-websocket/shenyu-client-spring-websocket/src/main/java/org/apache/shenyu/client/spring/websocket/init/SpringWebSocketClientEventListener.java:229 and inspect the enabled attribute in ShenyuSpringWebSocketClient.java:68. Compare the WebSocket metadata registration with the SOFA and Tars listeners, then verify that enabled=false registers the route as disabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.