apache / apache/shenyu

[BUG] HttpClientRegisterRepository uses static mutable URI/ApiDoc fields — only the last DTO is offlined on shutdown, with cross-instance leakage

Open
#6,778 1 comment 0 reactions 0 assignees View on GitHub
priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: Medium
- Location:
`shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java:59,61` (static fields), `:127` (`uriRegisterDTO = registerDTO`), `:157` (`apiDocRegisterDTO = registerDTO`), `:171-180` (closeRepository)
-
Description:
`uriRegisterDTO` and `apiDocRegisterDTO` are `static` mutable fields overwritten on every `doPersistURI`/`doPersistApiDoc`. `closeRepository()` (priority-1 shutdown hook) only re-registers the *last*-registered URI and the *last*-registered apiDoc; every earlier one is skipped. Because the fields are `static`, multiple repository instances (multiple register types in one JVM, re-init, tests) share and overwrite each other's DTOs. No memory barrier between writer (register thread) and reader (shutdown hook thread).
-
Impact:
Graceful shutdown only offlines the most-recent apiDoc (URI is mitigated by the separate per-URI OFFLINE hook in `ShenyuClientURIExecutorSubscriber:105-115`); stale apiDoc state remains for all earlier docs. Cross-instance overwrite can offline the wrong DTO.
-
Suggested fix:
Make the fields instance (non-static) and collect all registered DTOs (e.g. a `ConcurrentHashMap`/set) so `closeRepository` can offline each.
-
Confidence: High
- Related existing: none — #6487 (heartbeat scheduler), #6559/FUNC-E4 (register partial-failure) are different.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in shenyu-register-center/shenyu-register-client/shenyu-register-client-http/src/main/java/org/apache/shenyu/register/client/http/HttpClientRegisterRepository.java, reading doPersistURI, doPersistApiDoc, and closeRepository together with the referenced shutdown hook. Trace how registrations are stored across repository instances, then verify shutdown offlines every registered DTO without cross-instance leakage or missed updates.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
56/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.