apache / apache/shenyu

[BUG] SofaMetaDataHandler uses raw .equals on possibly-null fields → NPE

Open Beginner friendly
#6,740 1 comment 0 reactions 0 assignees View on GitHub
plugin: sofa priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-sofa/src/main/java/org/apache/shenyu/plugin/sofa/handler/SofaMetaDataHandler.java:39,43`
- description: `exist.getServiceName().equals(metaData.getServiceName())` and `exist.getRpcExt().equals(metaData.getRpcExt())` without null-safety. `MetaData.rpcExt` defaults to null. Unlike `AbstractDubboMetaDataHandler` which uses `Objects.equals(...)`, the sofa handler NPEs if a registered metadata has null `rpcExt`/`serviceName`.
- impact: A metadata re-handle event for a sofa path whose `rpcExt`/`serviceName` is null throws NPE.
- suggested_fix: Use `Objects.equals(...)` (as the dubbo handler does).
- confidence: Medium
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-sofa/src/main/java/org/apache/shenyu/plugin/sofa/handler/SofaMetaDataHandler.java at lines 39 and 43, then compare the null-safe handling in AbstractDubboMetaDataHandler. Verify that a metadata re-handle event with null rpcExt or serviceName no longer throws an NPE.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.