Aias00 opened a new issue, #6730: URL: https://github.com/apache/shenyu/issues/6730
- Severity: Medium - Location: `shenyu-plugin/shenyu-plugin-api/src/main/java/org/apache/shenyu/plugin/api/utils/SpringBeanUtils.java:138-143` (`getBeanName` lowercases simple class name); `shenyu-web/src/main/java/org/apache/shenyu/web/loader/ShenyuPluginClassLoader.java:142-147` (`close()` iterates all class names and calls `destroyBean(clazzName)`) - Description: `getBeanName(className)` uses the simple class name (lowercased first char) as the Spring bean name. Two plugins with a class of the same simple name share one bean slot. `close()` iterates `pluginJar.getClazzMap().keySet()` and calls `destroyBean(clazzName)` for every class in the jar — including names that may now be backed by a *different* classloader if another plugin defines the same simple name, or if a reload race caused the new CL to re-register before the old CL's `close()` runs. - Impact: `close()` of one plugin destroys another plugin's live bean → `BeanCreationException`/NPE on the surviving plugin at request time. - Suggested fix: Namespace bean names by classloader/jarKey (e.g. `beanName = jarKey + "#" + simpleName`); have `close()` only destroy beans it actually registered. - Confidence: Medium - Related existing: none --- ## E. Gateway-side data sync apply path (3 findings) --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
