[BUG] Sentinel rule handler read-modify-writes the global rule list non-atomically (lost updates)
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-fault-tolerance/shenyu-plugin-sentinel/src/main/java/org/apache/shenyu/plugin/sentinel/handler/SentinelRuleHandle.java:59-93`
- description: `handlerRule` builds the new global rule set by `FlowRuleManager.getRules().stream().filter(...).collect(...)` then `flowRules.add(rule)` then `FlowRuleManager.loadRules(flowRules)`. This get→filter→load is not atomic across concurrent rule sync events: two concurrent invocations each snapshot the pre-existing rules and each add only their own new rule; the second `loadRules` overwrites the first.
- impact: Concurrent rule create/update/remove events silently drop Sentinel flow/degrade rules.
- suggested_fix: Serialize the get-filter-load sequence or use Sentinel's per-resource rule API.
- confidence: Medium
- related_existing: none — #4668 is a general optimization, not this specific race.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in shenyu-plugin/shenyu-plugin-fault-tolerance/shenyu-plugin-sentinel/src/main/java/org/apache/shenyu/plugin/sentinel/handler/SentinelRuleHandle.java, especially handlerRule lines 59-93. Trace the concurrent get-filter-load sequence and verify it with concurrent rule create, update, or remove events. Done means concurrent synchronization no longer loses unrelated Sentinel flow or degrade rules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100