Aias00 opened a new issue, #6615: URL: https://github.com/apache/shenyu/issues/6615
- severity: High - files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java:124-136` - description: `selectByIdListAndNamespaceId(ids, namespaceId)` scopes the existence check by `namespaceId`, but the subsequent `metaDataMapper.updateEnableBatch(ids, enabled)` (line 132) is passed the **raw `ids`** with no `namespaceId` filter (verified: the mapper SQL at `meta-data-sqlmap.xml:225` is `WHERE id IN (...)` with no namespace). If a caller in namespace A supplies `ids = [id-in-A, id-in-B]`, the select returns only the A row (non-empty), so the method proceeds, and `updateEnableBatch` enables/disables the B row too. - impact: A user scoped to one namespace can enable/disable metadata belonging to another namespace, breaking namespace isolation and potentially disabling traffic in unrelated namespaces. - suggested_fix: Pass the filtered id list (`metaDataDoList.stream().map(MetaDataDO::getId)`) to `updateEnableBatch`, or add a `namespaceId` overload of the mapper update. - confidence: High - related_existing: none. The baseline MetaData items cover other concerns; this is a cross-namespace mutation bug. --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
