apache / apache/shenyu

[BUG] — Mass missing SQL pagination: 9 `listByPage` services lack `@Pageable` (fake pagination)

Open
#6,674 1 comment 0 reactions 0 assignees View on GitHub
admin priority: high type: performance
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High; files: `AppAuthServiceImpl.java:565-572` (`app-auth-sqlmap.xml:96-111`), `DashboardUserServiceImpl.java:289-293` (`dashboard-user-sqlmap.xml:66-74`), `NamespacePluginServiceImpl.java:136` (`namespace-plugin-rel-sqlmap.xml:74-112`), `ApiServiceImpl.java:261`, `MockRequestRecordServiceImpl.java:83-86` (`mock-request-record-sqlmap.xml:45-67`), `InstanceInfoServiceImpl.java:81-84` (`instance-info-sqlmap.xml:80-94`), `NamespaceServiceImpl.java:128` (`namespace-sqlmap.xml:191-210`), `RegistryServiceImpl.java:57` (`registry-sqlmap.xml:231-248`), `AiProxyApiKeyServiceImpl` (listByPage)
- description: `PageableAspect.java:54-75` only triggers `PageHelper.startPage` when the invoked method is annotated `@Pageable`. These nine are not, so `selectByQuery` runs unbounded and `PageResultUtils` merely wraps the full list with the page parameter object — "fake pagination".
- impact: Every list call materialises the entire filtered table into JVM heap; large tenants blow up memory and DB latency.
- suggested_fix: Annotate each `listByPage` with `@Pageable` (matching `SelectorServiceImpl`/`RuleServiceImpl`/`PluginServiceImpl`), or add explicit `LIMIT/OFFSET` to the mappers.
- confidence: High

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with PageableAspect.java:54-75 and compare SelectorServiceImpl, RuleServiceImpl, and PluginServiceImpl. Review the nine listByPage methods and their named SQL mapper ranges, including AppAuthServiceImpl.java:565-572 and app-auth-sqlmap.xml:96-111. Done means each listByPage applies real database pagination, either through @Pageable or explicit LIMIT/OFFSET, rather than wrapping an unbounded result.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, sql
Domain
backend, databases, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.