[BUG] Sign plugin can return 500 for malformed signature input

[Aias00]

Current Behavior

The Sign plugin has malformed-input paths that can throw unchecked exceptions instead of returning the normal signature verification failure response.

Examples in current origin/master:

• VersionTwoExtractor.extract() Base64-decodes and JSON-parses the first token segment without handling bad input.
• ComposableSignService.verifyExpires() only checks that the timestamp is nonblank before calling Long.parseLong(...).
• In the no-body verification path, SignPlugin.doExecute() does not convert these unchecked exceptions into SIGN_IS_NOT_PASS.

Malformed signature headers or nonnumeric timestamps can therefore escape as server errors instead of clean verification failures.

Expected Behavior

Invalid or malformed sign parameters should return the configured sign verification failure response, not an uncaught runtime exception.

Steps to Reproduce

1. Enable the Sign plugin on a route.
2. Send a request with malformed ShenYu-Authorization / Authorization sign data, or with a nonnumeric timestamp in the decoded sign parameters.
3. The plugin can throw during extraction or expiry verification instead of returning SIGN_IS_NOT_PASS.

Code Location

• shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign/src/main/java/org/apache/shenyu/plugin/sign/extractor/VersionTwoExtractor.java
• shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign/src/main/java/org/apache/shenyu/plugin/sign/service/ComposableSignService.java
• shenyu-plugin/shenyu-plugin-security/shenyu-plugin-sign/src/main/java/org/apache/shenyu/plugin/sign/SignPlugin.java

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] Sign plugin can return 500 for malformed signature input
• Link: [BUG] Sign plugin can return 500 for malformed signature input #6475

Please review when you have time. Thank you! 🙏