apache / apache/shenyu

[BUG] NPE from null RemoteAddress

Open Beginner friendly
#6,760 1 comment 0 reactions 0 assignees View on GitHub
plugin: grpc priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/GrpcPlugin.java:99-100`
- description: `Objects.requireNonNull(exchange.getRequest().getRemoteAddress()).getAddress().getHostAddress()` throws NPE if `getRemoteAddress()` returns null (connection closed, proxied without forwarded headers).
- impact: Uncaught NPE fails the gRPC request entirely.
- suggested_fix: Guard with `Optional.ofNullable(...)` and use a fallback.
- confidence: Medium
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/GrpcPlugin.java at lines 99-100 and trace how the remote address is used. Verify the request path when getRemoteAddress() returns null, including closed or proxied connections, and confirm that it completes without an uncaught NPE by using the agreed fallback.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.