You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shenyu.apache.org by "Aias00 (via GitHub)" <gi...@apache.org> on 2026/08/03 00:49:32 UTC
[I] [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass) [shenyu]
Aias00 opened a new issue, #6615:
URL: https://github.com/apache/shenyu/issues/6615
- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java:124-136`
- description: `selectByIdListAndNamespaceId(ids, namespaceId)` scopes the existence check by `namespaceId`, but the subsequent `metaDataMapper.updateEnableBatch(ids, enabled)` (line 132) is passed the **raw `ids`** with no `namespaceId` filter (verified: the mapper SQL at `meta-data-sqlmap.xml:225` is `WHERE id IN (...)` with no namespace). If a caller in namespace A supplies `ids = [id-in-A, id-in-B]`, the select returns only the A row (non-empty), so the method proceeds, and `updateEnableBatch` enables/disables the B row too.
- impact: A user scoped to one namespace can enable/disable metadata belonging to another namespace, breaking namespace isolation and potentially disabling traffic in unrelated namespaces.
- suggested_fix: Pass the filtered id list (`metaDataDoList.stream().map(MetaDataDO::getId)`) to `updateEnableBatch`, or add a `namespaceId` overload of the mapper update.
- confidence: High
- related_existing: none. The baseline MetaData items cover other concerns; this is a cross-namespace mutation bug.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass) [shenyu]
Posted by "dengliming (via GitHub)" <gi...@apache.org>.
dengliming closed issue #6615: [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass)
URL: https://github.com/apache/shenyu/issues/6615
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass) [shenyu]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #6615:
URL: https://github.com/apache/shenyu/issues/6615#issuecomment-5161204913
👋 Hello @Aias00
A new issue has been opened by @Aias00:
- **Title**: [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass)
- **Link**: https://github.com/apache/shenyu/issues/6615
Please review when you have time. Thank you! 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass) [shenyu]
Posted by "wy471x (via GitHub)" <gi...@apache.org>.
wy471x commented on issue #6615:
URL: https://github.com/apache/shenyu/issues/6615#issuecomment-5389047730
/assign
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org