(shenyu) branch master updated: fix(admin): validate resource update requests (#6617) (#7170)

[liuhongyu]

This is an automated email from the ASF dual-hosted git repository.

Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git


The following commit(s) were added to refs/heads/master by this push:
     new edc9784540 fix(admin): validate resource update requests (#6617) 
(#7170)
edc9784540 is described below

commit edc9784540951e30ea7ac2a5955ddcf060d27d97
Author: BobSong <2434005...@qq.com>
AuthorDate: Wed Sep 30 09:58:49 2026 +0800

    fix(admin): validate resource update requests (#6617) (#7170)
    
    Co-authored-by: BobSong-dev <bobsong...@gmail.com>
    Co-authored-by: aias00 <liuhon...@apache.org>
---
 .../admin/controller/ResourceController.java       |  2 +-
 .../admin/controller/ResourceControllerTest.java   | 24 +++++++++++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git 
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java
 
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java
index 1875121418..88e00a2ae2 100644
--- 
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java
+++ 
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ResourceController.java
@@ -149,7 +149,7 @@ public class ResourceController {
     public ShenyuAdminResult updateResource(@PathVariable("id") @Valid
                                             @Existed(provider = 
ResourceMapper.class,
                                                     message = "resource not 
existed") final String id,
-                                            @RequestBody final ResourceDTO 
resourceDTO) {
+                                            @Valid @RequestBody final 
ResourceDTO resourceDTO) {
         resourceDTO.setId(id);
         return ShenyuAdminResult.success(ShenyuResultMessage.UPDATE_SUCCESS, 
resourceService.update(resourceDTO));
     }
diff --git 
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/ResourceControllerTest.java
 
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/ResourceControllerTest.java
index 0b520c8eae..94745832be 100644
--- 
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/ResourceControllerTest.java
+++ 
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/ResourceControllerTest.java
@@ -21,7 +21,11 @@ import static com.google.common.collect.Lists.newArrayList;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 import static 
org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static 
org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static 
org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
 import org.apache.shenyu.admin.exception.ExceptionHandlers;
 import org.apache.shenyu.admin.mapper.ResourceMapper;
@@ -37,6 +41,7 @@ import org.apache.shenyu.admin.service.ResourceService;
 import org.apache.shenyu.admin.spring.SpringBeanUtils;
 import org.apache.shenyu.admin.utils.ShenyuResultMessage;
 import org.apache.shenyu.common.utils.GsonUtils;
+import org.hamcrest.Matchers;
 
 import java.util.Collections;
 import java.util.List;
@@ -191,7 +196,10 @@ public class ResourceControllerTest {
         final ResourceDTO resourceDTO = new ResourceDTO();
         resourceDTO.setId(mockId);
         fill(resourceDTO);
-        
SpringBeanUtils.getInstance().setApplicationContext(mock(ConfigurableApplicationContext.class));
+        final ConfigurableApplicationContext applicationContext = 
mock(ConfigurableApplicationContext.class);
+        
given(applicationContext.getBean(ResourceMapper.class)).willReturn(resourceMapper);
+        given(resourceMapper.existed(mockId)).willReturn(true);
+        
SpringBeanUtils.getInstance().setApplicationContext(applicationContext);
         given(resourceService.update(resourceDTO)).willReturn(1);
 
         this.mockMvc.perform(MockMvcRequestBuilders.put("/resource/" + mockId)
@@ -200,6 +208,20 @@ public class ResourceControllerTest {
                 
.andExpect(content().json(GsonUtils.getInstance().toJson(ShenyuAdminResult.success(ShenyuResultMessage.UPDATE_SUCCESS,
 1))))
                 .andReturn();
     }
+
+    @Test
+    public void testUpdateResourceRejectsInvalidBody() throws Exception {
+        final String mockId = "mock-id";
+
+        this.mockMvc.perform(MockMvcRequestBuilders.put("/resource/" + mockId)
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(GsonUtils.getInstance().toJson(new 
ResourceDTO())))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.message", 
Matchers.containsString("Request error! invalid argument")))
+                .andReturn();
+
+        verify(resourceService, never()).update(any());
+    }
     
     @Test
     public void testDeleteResource() throws Exception {