Description
In parseUpstream, the protocol array is populated from annotations.get(UPSTREAMS_PROTOCOL_ANNOTATION_KEY).split(",") (line 307). Then for each endpoint address, line 325 does protocol[i++] where i increments per address. If the user provides fewer comma-separated protocol values than there are endpoint addresses (e.g. 2 protocols for 3 endpoints), i exceeds the array bounds and throws ArrayIndexOutOfBoundsException. The sibling DubboIngressParser (line 348-349) has the same protocol[i++] pattern.
Location
shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/parser/DivideIngressParser.java:325 (same at DubboIngressParser.java:348-349)
Impact
An ingress with a mismatched upstreams-protocol annotation (fewer protocols than endpoints) crashes the reconcile, blocking route configuration.
Suggested fix
Guard with protocol.length > i ? protocol[i++] : "http://" (or cycle: protocol[i % protocol.length]), and add a bounds check.
Related existing
None — #6598 covers http:// hardcode in EndpointsReconciler; this is an AIOOBE in the parser.
Description
In
parseUpstream, theprotocolarray is populated fromannotations.get(UPSTREAMS_PROTOCOL_ANNOTATION_KEY).split(",")(line 307). Then for each endpoint address, line 325 doesprotocol[i++]whereiincrements per address. If the user provides fewer comma-separated protocol values than there are endpoint addresses (e.g. 2 protocols for 3 endpoints),iexceeds the array bounds and throwsArrayIndexOutOfBoundsException. The siblingDubboIngressParser(line 348-349) has the sameprotocol[i++]pattern.Location
shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/parser/DivideIngressParser.java:325(same atDubboIngressParser.java:348-349)Impact
An ingress with a mismatched
upstreams-protocolannotation (fewer protocols than endpoints) crashes the reconcile, blocking route configuration.Suggested fix
Guard with
protocol.length > i ? protocol[i++] : "http://"(or cycle:protocol[i % protocol.length]), and add a bounds check.Related existing
None — #6598 covers http:// hardcode in
EndpointsReconciler; this is an AIOOBE in the parser.