[BUG] ScaleRuleServiceImpl.create caches a rule with a different ID than the one inserted (double UUID generation)

[Aias00]

• severity: High
• files: shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ScaleRuleServiceImpl.java:107-115; shenyu-admin/src/main/java/org/apache/shenyu/admin/model/entity/ScaleRuleDO.java:212-216
• description: In create(...), ScaleRuleDO.buildScaleRuleDO(scaleRuleDTO) is called twice. buildScaleRuleDO generates a fresh UUIDUtils.getInstance().generateShortUuid() whenever the DTO id is blank (line 212-213). The first build (scaleRuleDO, line 107) gets UUID A and is inserted. The second build on line 112 runs on the same scaleRuleDTO whose id is STILL blank, so it generates a brand-new UUID B and stores that in ScaleRuleCache.
• impact: The cache holds a phantom rule (UUID B) that does not correspond to any DB row (UUID A). Subsequent removeRulesFromCache(ids) keyed by the real DB id will not touch the phantom; the scaler may operate on a rule that does not exist, or ignore the real one. Cache/DB divergence.
• suggested_fix: Reuse the inserted DO for the cache: scaleRuleCache.addOrUpdateRuleToCache(scaleRuleDO); (remove the second buildScaleRuleDO call). The same double-build pattern exists in update (line 128).
• confidence: High
• related_existing: none.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] ScaleRuleServiceImpl.create caches a rule with a different ID than the one inserted (double UUID generation)
• Link: [BUG] ScaleRuleServiceImpl.create caches a rule with a different ID than the one inserted (double UUID generation) #6623

Please review when you have time. Thank you! 🙏