- Severity: High
- Location:
shenyu-plugin/shenyu-plugin-global/src/main/java/org/apache/shenyu/plugin/global/DefaultShenyuContextBuilder.java:62 (decoratorMap.get(buildData.getLeft()).decorator(...)); trigger at :68 (rpc_type request header)
Description:
build() does decoratorMap.get(buildData.getLeft()).decorator(...) with no null guard. buildData.getLeft() is the rpc type string. buildData line 68 reads headers.getFirst("rpc_type") directly from the incoming HTTP request. A client sending rpc_type: bogus makes buildData return Pair.of("bogus", new MetaData()). "bogus" is not a key in decoratorMap → get returns null → .decorator(...) NPEs inside GlobalPlugin.execute → 500 on the request thread. Also fires if a registered MetaData.rpcType has no matching decorator bean (plugin module absent).
Impact:
Single unauthenticated request with a bogus rpc_type header crashes GlobalPlugin with NPE (trivial DoS); misconfigured metadata crashes all requests of that rpc type.
Suggested fix:
Validate rpcType against decoratorMap.containsKey(...); fall back to HTTP decorator or reject with 400. Treat the client rpc_type header as untrusted.
Confidence: High
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.
shenyu-plugin/shenyu-plugin-global/src/main/java/org/apache/shenyu/plugin/global/DefaultShenyuContextBuilder.java:62(decoratorMap.get(buildData.getLeft()).decorator(...)); trigger at:68(rpc_typerequest header)Description:
build()doesdecoratorMap.get(buildData.getLeft()).decorator(...)with no null guard.buildData.getLeft()is the rpc type string.buildDataline 68 readsheaders.getFirst("rpc_type")directly from the incoming HTTP request. A client sendingrpc_type: bogusmakesbuildDatareturnPair.of("bogus", new MetaData())."bogus"is not a key indecoratorMap→getreturns null →.decorator(...)NPEs insideGlobalPlugin.execute→ 500 on the request thread. Also fires if a registeredMetaData.rpcTypehas no matching decorator bean (plugin module absent).Impact:
Single unauthenticated request with a bogus
rpc_typeheader crashesGlobalPluginwith NPE (trivial DoS); misconfigured metadata crashes all requests of that rpc type.Suggested fix:
Validate
rpcTypeagainstdecoratorMap.containsKey(...); fall back to HTTP decorator or reject with 400. Treat the clientrpc_typeheader as untrusted.Confidence: High
Upgradecase-sensitivity in the same method but a different branch; this is the missing null-guard on the decorator-map lookup.Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/00-consolidated-critical-high.md.