[BUG] HttpClientRegisterRepository uses static mutable URI/ApiDoc fields — only the last DTO is offlined on shutdown, with cross-instance leakage
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- Severity: Medium
- Location:
`shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java:59,61` (static fields), `:127` (`uriRegisterDTO = registerDTO`), `:157` (`apiDocRegisterDTO = registerDTO`), `:171-180` (closeRepository)
-
Description:
`uriRegisterDTO` and `apiDocRegisterDTO` are `static` mutable fields overwritten on every `doPersistURI`/`doPersistApiDoc`. `closeRepository()` (priority-1 shutdown hook) only re-registers the *last*-registered URI and the *last*-registered apiDoc; every earlier one is skipped. Because the fields are `static`, multiple repository instances (multiple register types in one JVM, re-init, tests) share and overwrite each other's DTOs. No memory barrier between writer (register thread) and reader (shutdown hook thread).
-
Impact:
Graceful shutdown only offlines the most-recent apiDoc (URI is mitigated by the separate per-URI OFFLINE hook in `ShenyuClientURIExecutorSubscriber:105-115`); stale apiDoc state remains for all earlier docs. Cross-instance overwrite can offline the wrong DTO.
-
Suggested fix:
Make the fields instance (non-static) and collect all registered DTOs (e.g. a `ConcurrentHashMap`/set) so `closeRepository` can offline each.
-
Confidence: High
- Related existing: none — #6487 (heartbeat scheduler), #6559/FUNC-E4 (register partial-failure) are different.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java, reading doPersistURI, doPersistApiDoc, and closeRepository together with the referenced shutdown hook. Trace how registrations are stored across repository instances, then verify shutdown offlines every registered DTO without cross-instance leakage or missed updates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 56/100