[BUG] ModifyResponsePlugin silently skips all modifications for streaming responses (writeAndFlushWith not overridden)

[Aias00]

• severity: High
• files: shenyu-plugin/shenyu-plugin-modify-response/src/main/java/org/apache/shenyu/plugin/modify/response/ModifyResponsePlugin.java:83-107
• description: ModifyResponseDecorator extends ServerHttpResponseDecorator and overrides only writeWith. The parent's writeAndFlushWith delegates directly to getDelegate().writeAndFlushWith(body). When the upstream response is streaming (SSE / text/event-stream, NDJSON), NettyClientMessageWriter calls response.writeAndFlushWith(...) which bypasses the decorator entirely. modifyResponseHeadersAndStatus() is never invoked — no header/status modification is applied.
• impact: All ModifyResponse header and status rules are silently ignored for SSE/NDJSON responses, with no error.
• suggested_fix: Override writeAndFlushWith in ModifyResponseDecorator to call modifyResponseHeadersAndStatus() before delegating.
• confidence: High
• related_existing: none — [BUG] I want to modify the content-type of returning data, but the modified Content-Type cannot take effect #5594 is content-type via WebFluxResultUtils; this is the writeAndFlushWith bypass affecting all header/status mods for streaming.

---

Medium

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] ModifyResponsePlugin silently skips all modifications for streaming responses (writeAndFlushWith not overridden)
• Link: [BUG] ModifyResponsePlugin silently skips all modifications for streaming responses (writeAndFlushWith not overridden) #6659

Please review when you have time. Thank you! 🙏