apache / apache/shenyu

[Task] — Sign algorithm version providers/extractors with zero test

Open
#6,814 2 comments 0 reactions 1 assignee Claimed by @yykaue View on GitHub
in: test plugin: sign priority: medium type: refactor
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: High/Medium; files: `shenyu-plugin-security/shenyu-plugin-sign/.../sign/provider/VersionOneSignProvider.java:33`, `VersionTwoSignProvider.java:27`, `.../extractor/VersionOneExtractor.java`, `VersionTwoExtractor.java`
- description: v1/v2 signing algorithm providers and parameter extractors are untested (verified by content grep). `SignUtils` is exercised via `AppAuthMapperTest`, `ComposableSignService`/`DefaultSignProvider`/`DefaultExtractor` via `SignPluginTest` — but the version-specific providers/extractors are not.
- suggested_fix: Add provider/extractor tests covering match/no-match/edge cases.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.