- Severity: Medium
- Location:
shenyu-client/shenyu-client-core/src/main/java/org/apache/shenyu/client/core/shutdown/ShenyuClientShutdownHook.java:85-96
Description:
In TakeoverOtherHooksThread.run(), the reflection block (lines 86-93) attempts to get java.lang.ApplicationShutdownHooks.hooks. If this fails (ClassNotFoundException, NoSuchFieldException, IllegalAccessException — restricted SecurityManager, non-standard/future JDK where the internal class changes), hooks remains null. The catch logs the error but execution continues to line 95's while loop. At line 96, Objects.requireNonNull(hooks) throws NullPointerException outside any try-catch; the thread terminates with an uncaught exception. The entire "delay other shutdown hooks" mechanism (which ensures the shenyu offline event reaches admin before Spring's shutdown hooks close connections) is silently broken.
Impact:
On environments where ApplicationShutdownHooks reflection fails, shutdown-hook delay is inactive. The client's closeRepository/offline may race with or run after Spring's connection-closing hooks, so the offline event never reaches admin. Stale URI entries persist on the admin side.
Suggested fix:
Add if (hooks == null) { LOG.warn("Could not access ApplicationShutdownHooks, skipping hook delay"); return; } immediately after the try-catch block (before line 94).
Confidence: High
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/06-medium-tiers.md.
shenyu-client/shenyu-client-core/src/main/java/org/apache/shenyu/client/core/shutdown/ShenyuClientShutdownHook.java:85-96Description:
In
TakeoverOtherHooksThread.run(), the reflection block (lines 86-93) attempts to getjava.lang.ApplicationShutdownHooks.hooks. If this fails (ClassNotFoundException,NoSuchFieldException,IllegalAccessException— restricted SecurityManager, non-standard/future JDK where the internal class changes),hooksremains null. The catch logs the error but execution continues to line 95's while loop. At line 96,Objects.requireNonNull(hooks)throwsNullPointerExceptionoutside any try-catch; the thread terminates with an uncaught exception. The entire "delay other shutdown hooks" mechanism (which ensures the shenyu offline event reaches admin before Spring's shutdown hooks close connections) is silently broken.Impact:
On environments where
ApplicationShutdownHooksreflection fails, shutdown-hook delay is inactive. The client'scloseRepository/offlinemay race with or run after Spring's connection-closing hooks, so the offline event never reaches admin. Stale URI entries persist on the admin side.Suggested fix:
Add
if (hooks == null) { LOG.warn("Could not access ApplicationShutdownHooks, skipping hook delay"); return; }immediately after the try-catch block (before line 94).Confidence: High
Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/06-medium-tiers.md.