apache / apache/shenyu

[BUG] — `operation_record_log.selectByCondition`: unbounded audit-log scan, leading-wildcard LIKE on TEXT, no pagination, no index

Open
#6,675 1 comment 0 reactions 0 assignees View on GitHub
admin priority: high type: performance
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High; files: `mappers/operation-record-log-sqlmap.xml:70-88`; service `OperationRecordLogServiceImpl.java:58-61` (returns raw list, no paging)
- description: `context like concat('%',#{keyword},'%')` and `context not like concat('%',#{excluded},'%')` on a TEXT column; `operation_record_log` schema (`schema.sql:357-365`) defines no index on `operation_time` or `operator`; no `LIMIT`.
- impact: A wide time-range query scans and sorts the entire audit log; latency/temp-space grows with table size.
- suggested_fix: Add index on `(operation_time, operator)`; add `LIMIT`/`@Pageable`; use full-text or a generated prefix index instead of `'%kw%'`.
- confidence: High

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with mappers/operation-record-log-sqlmap.xml:70-88 and OperationRecordLogServiceImpl.java:58-61, then inspect schema.sql:357-365 and the consolidated scan report. Reproduce the wide time-range audit-log query and measure its scan, sort, and result size. Done means the query is bounded and indexed appropriately, pagination works, and performance is verified without changing the requested audit-log behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, sql
Domain
backend, databases, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.