[BUG] SelectorDataRefresh.refresh() NPE on null data / no-op on empty data (HTTP sync)

[Aias00]

• Severity: High
• Location:
  shenyu-sync-data-center/shenyu-sync-data-http/src/main/java/org/apache/shenyu/sync/data/http/refresh/SelectorDataRefresh.java:71-81

Description:
if (CollectionUtils.isEmpty(data)) { ...; data.forEach(pluginDataSubscriber::unSelectorSubscribe); pluginDataSubscriber.refreshSelectorDataAll(); }. CollectionUtils.isEmpty(null) returns true, so the branch is entered with data == null, then data.forEach(...) throws NullPointerException. If data is an empty list, forEach is a no-op (unsubscribe nothing) and the clear intent is not achieved. The ordering is also backwards (forEach before refreshSelectorDataAll). Compare PluginDataRefresh which correctly calls refreshPluginDataAll() first and returns before iterating.

Impact:
HTTP sync refresh with an empty/null selector group crashes the long-polling task (NPE) or silently leaves stale selectors in cache.

Suggested fix:
Move pluginDataSubscriber.refreshSelectorDataAll() to before the empty check, and return early when empty (same pattern as PluginDataRefresh).

Confidence: High

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] SelectorDataRefresh.refresh() NPE on null data / no-op on empty data (HTTP sync)
• Link: [BUG] SelectorDataRefresh.refresh() NPE on null data / no-op on empty data (HTTP sync) #6662

Please review when you have time. Thank you! 🙏