[BUG] handleMessageEndpoint builds JSON via String.format without escaping + default-charset bytes
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/McpServerPlugin.java:608-613`
- description: The SSE `/message` endpoint returns `String.format("{\"message\":\"%s\"}", result.getResponseBody())` then `responseBody.getBytes()`. Any `"`/`\`/control char in the message breaks the JSON. `getBytes()` uses platform default charset (inconsistent with line 479 which uses `StandardCharsets.UTF_8`).
- impact: Malformed JSON for messages containing quotes/backslashes; encoding corruption for non-ASCII.
- suggested_fix: Serialize with shared `ObjectMapper` and `getBytes(StandardCharsets.UTF_8)`.
- confidence: High
- related_existing: none — PERF-22 is perf; this is escaping/encoding.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/McpServerPlugin.java:608-613 and inspect the SSE /message response construction, comparing its encoding with line 479. Verify that message quotes, backslashes, control characters, and non-ASCII text produce valid JSON encoded as UTF-8; the issue is done when these cases no longer break or corrupt the response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100