apache / apache/shenyu

[BUG] handleMessageEndpoint builds JSON via String.format without escaping + default-charset bytes

Open Beginner friendly
#6,748 1 comment 0 reactions 0 assignees View on GitHub
feature: plugin priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/McpServerPlugin.java:608-613`
- description: The SSE `/message` endpoint returns `String.format("{\"message\":\"%s\"}", result.getResponseBody())` then `responseBody.getBytes()`. Any `"`/`\`/control char in the message breaks the JSON. `getBytes()` uses platform default charset (inconsistent with line 479 which uses `StandardCharsets.UTF_8`).
- impact: Malformed JSON for messages containing quotes/backslashes; encoding corruption for non-ASCII.
- suggested_fix: Serialize with shared `ObjectMapper` and `getBytes(StandardCharsets.UTF_8)`.
- confidence: High
- related_existing: none — PERF-22 is perf; this is escaping/encoding.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/McpServerPlugin.java:608-613 and inspect the SSE /message response construction, comparing its encoding with line 479. Verify that message quotes, backslashes, control characters, and non-ASCII text produce valid JSON encoded as UTF-8; the issue is done when these cases no longer break or corrupt the response.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.