[BUG] meta_data.pathExistedExclude ignores namespace_id → cross-namespace false-positive path collision
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 9h
- Merged PRs (30d)
- 83
Description
- severity: Medium
- files: `shenyu-admin/src/main/resources/mappers/meta-data-sqlmap.xml:154-163`; caller `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java:301`
- description: `pathExisted` (line 146) correctly scopes by `namespace_id`, but `pathExistedExclude` (used on update) does `WHERE path = #{path} AND id NOT IN (...)` with NO `namespace_id` filter (verified). So when updating a meta_data whose path also exists in a *different* namespace, this returns non-null and the service raises `DATA_PATH_IS_EXIST`, blocking a legitimate update.
- impact: False "path already exists" errors on meta_data update when the path is legitimately unique within the target namespace but present elsewhere.
- suggested_fix: Add `AND namespace_id = #{namespaceId}` to `pathExistedExclude` and pass namespaceId from the service.
- confidence: High
- related_existing: none.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with shenyu-admin/src/main/resources/mappers/meta-data-sqlmap.xml:146-163 and compare pathExisted with pathExistedExclude, then trace the update caller at shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java:301. Done means updates no longer report DATA_PATH_IS_EXIST when the same path exists only in another namespace, while same-namespace collisions remain detected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, sql
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100