You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@shenyu.apache.org by "Aias00 (via GitHub)" <gi...@apache.org> on 2026/08/03 01:09:23 UTC
[I] [BUG] RegistryController.delete and NamespaceController.delete accept an empty id list, producing invalid `IN ()` SQL [shenyu]
Aias00 opened a new issue, #6687:
URL: https://github.com/apache/shenyu/issues/6687
- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/RegistryController.java:110`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/NamespaceController.java:106`; `shenyu-admin/src/main/resources/mappers/registry-sqlmap.xml:260-266`; `shenyu-admin/src/main/resources/mappers/namespace-sqlmap.xml:246-252`
- description: Both endpoints use `@RequestBody final List<@NotBlank String> ids` but omit `@NotEmpty` (contrast with AppAuthController, PluginController which use `@RequestBody @NotEmpty final List<@NotBlank String> ids`). An empty list passes the per-element `@NotBlank` check vacuously and reaches `deleteByIds(ids)`, whose XML renders `WHERE id IN <foreach ...>` — with an empty collection yields `DELETE ... WHERE id IN ()`, a SQL syntax error.
- impact: An authenticated user can trigger an unhandled SQL exception / HTTP 500 (and a stack-trace leak) by POSTing `[]`.
- suggested_fix: Add `@NotEmpty` to both `@RequestBody List<...>` parameters.
- confidence: High
- related_existing: none.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] RegistryController.delete and NamespaceController.delete accept an empty id list, producing invalid `IN ()` SQL [shenyu]
Posted by "Aias00 (via GitHub)" <gi...@apache.org>.
Aias00 closed issue #6687: [BUG] RegistryController.delete and NamespaceController.delete accept an empty id list, producing invalid `IN ()` SQL
URL: https://github.com/apache/shenyu/issues/6687
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [BUG] RegistryController.delete and NamespaceController.delete accept an empty id list, producing invalid `IN ()` SQL [shenyu]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #6687:
URL: https://github.com/apache/shenyu/issues/6687#issuecomment-5161300318
👋 Hello @Aias00
A new issue has been opened by @Aias00:
- **Title**: [BUG] RegistryController.delete and NamespaceController.delete accept an empty id list, producing invalid `IN ()` SQL
- **Link**: https://github.com/apache/shenyu/issues/6687
Please review when you have time. Thank you! 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@shenyu.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org