apache / apache/shenyu

[BUG] TagServiceImpl.delete does not cascade to tag_relation or child tags

Open
#6,692 1 comment 0 reactions 0 assignees View on GitHub
admin priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/TagServiceImpl.java:106-107`
- description: `delete` calls only `tagMapper.deleteByIds(ids)`. `tag` is self-referential (`parent_tag_id`) and is referenced by `tag_relation.tag_id`. Deleting a tag orphans its children (children keep a dangling `parent_tag_id`) and leaves `tag_relation` rows pointing at a deleted tag.
- impact: Referential integrity loss; child tags become unreachable/misparented; API↔tag relations leak.
- suggested_fix: Before deleting, re-parent or reject children (query `selectByParentTagIds`) and delete `tag_relation` rows for the deleted tag ids; wrap in `@Transactional`.
- confidence: High
- related_existing: none.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/TagServiceImpl.java:106-107 and trace delete, tagMapper.deleteByIds, and selectByParentTagIds. Determine how child tags should be re-parented or rejected, remove tag_relation rows for deleted IDs, and verify the operations are covered by a transaction without leaving dangling references.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.