- Severity: Medium
- Location:
shenyu-client/shenyu-client-tars/src/main/java/org/apache/shenyu/client/tars/TarsServiceBeanEventListener.java:169
Description:
getBeans (line 98-100) uses context.getBeansWithAnnotation(ShenyuTarsService.class), which relies on Spring's AnnotatedElementUtils and finds the annotation through interfaces/superclass hierarchy. But buildMetaDataDTO (line 169) uses plain reflection clazz.getAnnotation(ShenyuTarsService.class).serviceName(). ShenyuTarsService is not @Inherited (ShenyuTarsService.java:28-30: only @Retention/@Target(TYPE)), so Java reflection's getAnnotation only sees the annotation when declared directly on clazz. clazz is AopUtils.getTargetClass(bean) (line 139), the concrete servant class. For Tars, where servants are interface-based, a user placing @ShenyuTarsService on the interface (allowed by @Target(TYPE)) will have the bean discovered but then NPE on getAnnotation(...).serviceName().
Impact:
NullPointerException during context refresh for Tars servants annotated via interface/superclass; the servant is selected for processing but its metadata build crashes.
Suggested fix:
Use AnnotatedElementUtils.findMergedAnnotation(clazz, ShenyuTarsService.class) instead of clazz.getAnnotation(...) (the rest of this class already uses AnnotatedElementUtils for ShenyuTarsClient), and null-check before .serviceName().
Confidence: Medium
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/06-medium-tiers.md.
shenyu-client/shenyu-client-tars/src/main/java/org/apache/shenyu/client/tars/TarsServiceBeanEventListener.java:169Description:
getBeans(line 98-100) usescontext.getBeansWithAnnotation(ShenyuTarsService.class), which relies on Spring'sAnnotatedElementUtilsand finds the annotation through interfaces/superclass hierarchy. ButbuildMetaDataDTO(line 169) uses plain reflectionclazz.getAnnotation(ShenyuTarsService.class).serviceName().ShenyuTarsServiceis not@Inherited(ShenyuTarsService.java:28-30: only@Retention/@Target(TYPE)), so Java reflection'sgetAnnotationonly sees the annotation when declared directly onclazz.clazzisAopUtils.getTargetClass(bean)(line 139), the concrete servant class. For Tars, where servants are interface-based, a user placing@ShenyuTarsServiceon the interface (allowed by@Target(TYPE)) will have the bean discovered but then NPE ongetAnnotation(...).serviceName().Impact:
NullPointerExceptionduring context refresh for Tars servants annotated via interface/superclass; the servant is selected for processing but its metadata build crashes.Suggested fix:
Use
AnnotatedElementUtils.findMergedAnnotation(clazz, ShenyuTarsService.class)instead ofclazz.getAnnotation(...)(the rest of this class already usesAnnotatedElementUtilsforShenyuTarsClient), and null-check before.serviceName().Confidence: Medium
ApplicationConfigCacheleak.Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/06-medium-tiers.md.