Aias00 opened a new issue, #6659: URL: https://github.com/apache/shenyu/issues/6659
- severity: High - files: `shenyu-plugin/shenyu-plugin-modify-response/src/main/java/org/apache/shenyu/plugin/modify/response/ModifyResponsePlugin.java:83-107` - description: `ModifyResponseDecorator` extends `ServerHttpResponseDecorator` and overrides only `writeWith`. The parent's `writeAndFlushWith` delegates directly to `getDelegate().writeAndFlushWith(body)`. When the upstream response is streaming (SSE / `text/event-stream`, NDJSON), `NettyClientMessageWriter` calls `response.writeAndFlushWith(...)` which bypasses the decorator entirely. `modifyResponseHeadersAndStatus()` is never invoked — no header/status modification is applied. - impact: All ModifyResponse header and status rules are silently ignored for SSE/NDJSON responses, with no error. - suggested_fix: Override `writeAndFlushWith` in `ModifyResponseDecorator` to call `modifyResponseHeadersAndStatus()` before delegating. - confidence: High - related_existing: none — #5594 is content-type via `WebFluxResultUtils`; this is the writeAndFlushWith bypass affecting all header/status mods for streaming. --- ## Medium --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
