apache / apache/shenyu

[BUG] WebsocketDataHandler stores handlers in a static mutable EnumMap mutated by every constructor

Open Beginner friendly
#6,732 1 comment 0 reactions 0 assignees View on GitHub
data-sync: websocket priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: Low-Medium
- Location:
`shenyu-sync-data-center/shenyu-sync-data-websocket/src/main/java/org/apache/shenyu/plugin/sync/data/websocket/handler/WebsocketDataHandler.java:35` (`private static final EnumMap ENUM_MAP`), populated in constructor `:50-57`, read at `:68`
-
Description:
`ENUM_MAP` is `static`, shared across all `WebsocketDataHandler` instances. `WebsocketSyncDataService` creates one `ShenyuWebsocketClient` (and thus one `WebsocketDataHandler`) per URL in `shenyu.sync.websocket.urls` (multiple for HA); `masterCheck`/recreate creates more. Each constructor overwrites the shared map; the last-constructed instance's handlers win for *all* clients.
-
Impact:
In standard single-subscriber deployment the injected subscribers are the same shared Spring beans, so the clobbering is masked. But it is fundamentally wrong (mutable static state initialized in a constructor) and becomes a live cross-talk defect for any multi-tenant or test wiring that supplies per-client subscriber lists.
-
Suggested fix:
Make `ENUM_MAP` a non-static instance field.
-
Confidence: High (as a defect), Low (production impact in standard config)
- Related existing: none

---

## F. Header/cookie/body manipulation plugins (4 findings)

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-sync-data-center/shenyu-sync-data-websocket/src/main/java/org/apache/shenyu/plugin/sync/data/websocket/handler/WebsocketDataHandler.java, especially the ENUM_MAP declaration and constructor. Read how WebsocketSyncDataService creates handlers for configured URLs, then verify that each handler retains its own subscribers and that constructing another client no longer overwrites existing handlers.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.