[BUG] — Mass missing SQL pagination: 9 `listByPage` services lack `@Pageable` (fake pagination)
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High; files: `AppAuthServiceImpl.java:565-572` (`app-auth-sqlmap.xml:96-111`), `DashboardUserServiceImpl.java:289-293` (`dashboard-user-sqlmap.xml:66-74`), `NamespacePluginServiceImpl.java:136` (`namespace-plugin-rel-sqlmap.xml:74-112`), `ApiServiceImpl.java:261`, `MockRequestRecordServiceImpl.java:83-86` (`mock-request-record-sqlmap.xml:45-67`), `InstanceInfoServiceImpl.java:81-84` (`instance-info-sqlmap.xml:80-94`), `NamespaceServiceImpl.java:128` (`namespace-sqlmap.xml:191-210`), `RegistryServiceImpl.java:57` (`registry-sqlmap.xml:231-248`), `AiProxyApiKeyServiceImpl` (listByPage)
- description: `PageableAspect.java:54-75` only triggers `PageHelper.startPage` when the invoked method is annotated `@Pageable`. These nine are not, so `selectByQuery` runs unbounded and `PageResultUtils` merely wraps the full list with the page parameter object — "fake pagination".
- impact: Every list call materialises the entire filtered table into JVM heap; large tenants blow up memory and DB latency.
- suggested_fix: Annotate each `listByPage` with `@Pageable` (matching `SelectorServiceImpl`/`RuleServiceImpl`/`PluginServiceImpl`), or add explicit `LIMIT/OFFSET` to the mappers.
- confidence: High
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with PageableAspect.java:54-75 and compare SelectorServiceImpl, RuleServiceImpl, and PluginServiceImpl. Review the nine listByPage methods and their named SQL mapper ranges, including AppAuthServiceImpl.java:565-572 and app-auth-sqlmap.xml:96-111. Done means each listByPage applies real database pagination, either through @Pageable or explicit LIMIT/OFFSET, rather than wrapping an unbounded result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, sql
- Domain
- backend, databases, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100