Aias00 opened a new issue, #6687: URL: https://github.com/apache/shenyu/issues/6687
- severity: Medium - files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/RegistryController.java:110`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/NamespaceController.java:106`; `shenyu-admin/src/main/resources/mappers/registry-sqlmap.xml:260-266`; `shenyu-admin/src/main/resources/mappers/namespace-sqlmap.xml:246-252` - description: Both endpoints use `@RequestBody final List<@NotBlank String> ids` but omit `@NotEmpty` (contrast with AppAuthController, PluginController which use `@RequestBody @NotEmpty final List<@NotBlank String> ids`). An empty list passes the per-element `@NotBlank` check vacuously and reaches `deleteByIds(ids)`, whose XML renders `WHERE id IN <foreach ...>` — with an empty collection yields `DELETE ... WHERE id IN ()`, a SQL syntax error. - impact: An authenticated user can trigger an unhandled SQL exception / HTTP 500 (and a stack-trace leak) by POSTing `[]`. - suggested_fix: Add `@NotEmpty` to both `@RequestBody List<...>` parameters. - confidence: High - related_existing: none. --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
