[BUG] TarsPlugin throws on empty/uninitialized proxy list (nextInt(0))

[Aias00]

• severity: High
• files: shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/TarsPlugin.java:81-83
• description: ApplicationConfigCache.get(path) is a Guava LoadingCache whose loader returns a TarsInvokePrxList(null,null,null) with an empty internal list when the path was never initialized. Line 82 ThreadLocalRandom.current().nextInt(tarsInvokePrxList.getTarsInvokePrxList().size()) throws IllegalArgumentException when the list is empty, outside the try/catch.
• impact: Any request for a tars path whose proxy list is not yet populated (race during sync, or no upstreams) results in uncaught IllegalArgumentException → 500.
• suggested_fix: Guard size() == 0 and return a proper no-upstream error via WebFluxResultUtils.result(...).
• confidence: High
• related_existing: none — [BUG] Tars ApplicationConfigCache: four unbounded ConcurrentHashMaps never evicted (class-loader leak) #6567 is about unbounded maps, not this NPE.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] TarsPlugin throws on empty/uninitialized proxy list (nextInt(0))
• Link: [BUG] TarsPlugin throws on empty/uninitialized proxy list (nextInt(0)) #6652

Please review when you have time. Thank you! 🙏