apache / apache/shenyu

[BUG] ProxySelectorServiceImpl.fetchData NPE on null discoveryHandler / discovery

Open Beginner friendly
#6,702 1 comment 0 reactions 0 assignees View on GitHub
admin priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:396-414`
- description: `discoveryHandlerMapper.selectById(discoveryHandlerId)` (398) is dereferenced at 399; `discoveryMapper.selectById(...)` (399) is dereferenced at 402/412. `proxySelectorDO` and `selectorDO` are null-checked, but handler and discovery are not. Exposed via PUT `/proxy-selector/fetch/{discoveryHandlerId}`.
- impact: Calling fetch with a stale handler id NPEs instead of returning a not-found result.
- suggested_fix: Guard `discoveryHandlerDO` and `discoveryDO`.
- confidence: Medium
- related_existing: none.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Open shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:396-414 and trace the PUT /proxy-selector/fetch/{discoveryHandlerId} path. Inspect the null handling around discoveryHandlerMapper.selectById and discoveryMapper.selectById. Done means stale handler or discovery IDs return a not-found result instead of causing an NPE.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.