- severity: High
- files:
shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/client/ShenyuGrpcClient.java:75,81
- description: When
parameterTypes is blank, param can be null and execution reaches client.call(). Inside call(), line 75 GsonUtils.getInstance().toObjectMap(requestJsons) with null returns null; JsonMessage.buildJsonMessageList(null) NPEs. Even if it returns an empty list, line 81 jsonRequestList.get(0) throws IndexOutOfBoundsException.
- impact: gRPC methods with no parameter types crash with an uncaught exception instead of being proxied.
- suggested_fix: Handle null/blank
requestJsons by building a single default empty DynamicMessage.
- confidence: High
- related_existing: none
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.
shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-grpc/src/main/java/org/apache/shenyu/plugin/grpc/client/ShenyuGrpcClient.java:75,81parameterTypesis blank,paramcan be null and execution reachesclient.call(). Insidecall(), line 75GsonUtils.getInstance().toObjectMap(requestJsons)with null returns null;JsonMessage.buildJsonMessageList(null)NPEs. Even if it returns an empty list, line 81jsonRequestList.get(0)throwsIndexOutOfBoundsException.requestJsonsby building a single default empty DynamicMessage.Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/00-consolidated-critical-high.md.