apache / apache/shenyu

[BUG] Static URIS list in ShenyuClientURIExecutorSubscriber leaks stale entries across context restarts

Open
#6,787 1 comment 0 reactions 0 assignees View on GitHub
client: register priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- Severity: Medium
- Location:
`shenyu-client/shenyu-client-core/src/main/java/org/apache/shenyu/client/core/disruptor/subcriber/ShenyuClientURIExecutorSubscriber.java:50`
-
Description:
`URIS` is `private static final List URIS = new CopyOnWriteArrayList<>()`, never cleared. On context restart in the same JVM (Spring DevTools, integration tests, embedded multi-app), URIs from the previous context remain; the heartbeat scheduler (line 67) sends heartbeats to dead/stale URIs; on shutdown the offline hook (line 105-115) sends `EventType.OFFLINE` for stale URIs that no longer correspond to a live instance. When `ShenyuClientRegisterEventPublisher.start()` is called multiple times (FUNC-B3), multiple subscriber instances each add to and heartbeat the same shared static list and each register an offline hook for all accumulated URIs.
-
Impact:
Stale heartbeat traffic to dead instances after restart; duplicate offline events; interference between different client type registrations sharing the same URIS list.
-
Suggested fix:
Make `URIS` an instance field so each subscriber tracks its own URIs; clear the list on shutdown; key URIs by namespace+contextPath+host+port and deduplicate.
-
Confidence: Medium
- Related existing: FUNC-B3 — covers the static URIS sharing across multiple `start()` calls; this adds the distinct stale-entries-across-context-restart facet (never cleared, DevTools/restart leaks).

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with shenyu-client/shenyu-client-core/src/main/java/org/apache/shenyu/client/core/disruptor/subcriber/ShenyuClientURIExecutorSubscriber.java, especially lines 50, 67, and 105-115, then trace ShenyuClientRegisterEventPublisher.start(). Verify the subscriber lifecycle across repeated starts and context shutdowns. Done means subscribers do not share stale URIs, heartbeat dead entries, or emit duplicate offline events.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
54/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.