[BUG] SofaMetaDataHandler uses raw .equals on possibly-null fields → NPE
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-sofa/src/main/java/org/apache/shenyu/plugin/sofa/handler/SofaMetaDataHandler.java:39,43`
- description: `exist.getServiceName().equals(metaData.getServiceName())` and `exist.getRpcExt().equals(metaData.getRpcExt())` without null-safety. `MetaData.rpcExt` defaults to null. Unlike `AbstractDubboMetaDataHandler` which uses `Objects.equals(...)`, the sofa handler NPEs if a registered metadata has null `rpcExt`/`serviceName`.
- impact: A metadata re-handle event for a sofa path whose `rpcExt`/`serviceName` is null throws NPE.
- suggested_fix: Use `Objects.equals(...)` (as the dubbo handler does).
- confidence: Medium
- related_existing: none
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-sofa/src/main/java/org/apache/shenyu/plugin/sofa/handler/SofaMetaDataHandler.java at lines 39 and 43, then compare the null-safe handling in AbstractDubboMetaDataHandler. Verify that a metadata re-handle event with null rpcExt or serviceName no longer throws an NPE.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100