[BUG] SelectorDataRefresh.refresh() NPE on null data / no-op on empty data (HTTP sync)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
Research direction
Start at shenyu-sync-data-center/shenyu-sync-data-http/src/main/java/org/apache/shenyu/sync/data/http/refresh/SelectorDataRefresh.java:71-81 and compare its flow with PluginDataRefresh, which is identified as the correct pattern. Verify that null and empty selector data clear existing subscriptions without throwing, and that refreshSelectorDataAll runs before the empty check.
Written by the indexing model from the issue text.
Description
- Severity: High
- Location:
shenyu-sync-data-center/shenyu-sync-data-http/src/main/java/org/apache/shenyu/sync/data/http/refresh/SelectorDataRefresh.java:71-81
Description:
if (CollectionUtils.isEmpty(data)) { ...; data.forEach(pluginDataSubscriber::unSelectorSubscribe); pluginDataSubscriber.refreshSelectorDataAll(); }. CollectionUtils.isEmpty(null) returns true, so the branch is entered with data == null, then data.forEach(...) throws NullPointerException. If data is an empty list, forEach is a no-op (unsubscribe nothing) and the clear intent is not achieved. The ordering is also backwards (forEach before refreshSelectorDataAll). Compare PluginDataRefresh which correctly calls refreshPluginDataAll() first and returns before iterating.
Impact:
HTTP sync refresh with an empty/null selector group crashes the long-polling task (NPE) or silently leaves stale selectors in cache.
Suggested fix:
Move pluginDataSubscriber.refreshSelectorDataAll() to before the empty check, and return early when empty (same pattern as PluginDataRefresh).
Confidence: High
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 4d 11h
- Merged PRs (30d)
- 85
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/shenyu
-
plugin: mock priority: medium type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
-
admin priority: medium type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
[BUG] DivideIngressParser protocol[i++] throws AIOOBE when protocol array shorter than endpoints Openkubernetes priority: medium type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
[BUG] ContextPathParser concatenates null annotation value with /** — literal null/** rule condition Openkubernetes priority: medium type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
kubernetes priority: medium type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
infinispan/infinispan#18150 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
opensearch-project/k-NN#3597 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100