You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shenyu.apache.org by "Aias00 (via GitHub)" <gi...@apache.org> on 2026/08/03 01:10:22 UTC
[I] [BUG] AiProxyApiKeyController.update bypasses bean validation (@Valid missing) [shenyu]
Aias00 opened a new issue, #6712:
URL: https://github.com/apache/shenyu/issues/6712
- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AiProxyApiKeyController.java:135`
- description: `create` (line 76) annotates `@Valid @RequestBody`, but `update` (line 135) uses `@RequestBody` without `@Valid`. `ProxyApiKeyDTO` declares `@NotBlank private String namespaceId` (line 59). On the update path this constraint is not enforced.
- impact: An update with a blank/changed namespaceId is accepted, risking cross-namespace data scoping inconsistency for AI proxy keys.
- suggested_fix: Add `@Valid` to the `@RequestBody` on line 135.
- confidence: High
- related_existing: none.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] AiProxyApiKeyController.update bypasses bean validation (@Valid missing) [shenyu]
Posted by "Aias00 (via GitHub)" <gi...@apache.org>.
Aias00 closed issue #6712: [BUG] AiProxyApiKeyController.update bypasses bean validation (@Valid missing)
URL: https://github.com/apache/shenyu/issues/6712
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] AiProxyApiKeyController.update bypasses bean validation (@Valid missing) [shenyu]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #6712:
URL: https://github.com/apache/shenyu/issues/6712#issuecomment-5161305289
👋 Hello @yuluo-yx
A new issue has been opened by @Aias00:
- **Title**: [BUG] AiProxyApiKeyController.update bypasses bean validation (@Valid missing)
- **Link**: https://github.com/apache/shenyu/issues/6712
Please review when you have time. Thank you! 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org