RockteMQ-AI commented on issue #10939:
URL: https://github.com/apache/rocketmq/issues/10939#issuecomment-5302819352
**Issue Evaluation**
Category: `bug` | Module: `proxy/remoting` | Status: **Confirmed**
The reported NPE is verified against the current codebase.
**Root Cause:** In
[`AbstractRemotingActivity.request()`](proxy/src/main/java/org/apache/rocketmq/proxy/remoting/activity/AbstractRemotingActivity.java#L72),
the code calls
`request.getExtFields().get(BROKER_NAME_FIELD_FOR_SEND_MESSAGE_V2)` without
first checking whether `getExtFields()` returns null.
`RemotingCommand.extFields` is declared as `private HashMap<String, String>
extFields` (line 92) with no default initialization, and `getExtFields()` (line
604) returns the raw field — so a decoded command with no extended fields will
have `extFields == null`, causing `NullPointerException`.
**Impact:** Any Remoting forwarding request (e.g. `PULL_MESSAGE`,
`SEND_MESSAGE_V2`) that arrives with null extFields will crash with NPE instead
of returning the intended `VERSION_NOT_SUPPORTED` / `REQUEST_CODE_NOT_FOUND`
protocol-level error. This turns a clean protocol error into an internal server
error visible to clients.
**Severity:** Medium — affects Proxy Remoting protocol path; exploitable by
any client that sends a command without ext fields.
**Affected code paths:**
- `AbstractRemotingActivity.request()` lines 72, 79 —
`getExtFields().get(...)` without null guard
- Both `BROKER_NAME_FIELD` ("bname") and
`BROKER_NAME_FIELD_FOR_SEND_MESSAGE_V2` ("n") lookups are affected
A fix should guard both lookups with a null check on `getExtFields()` before
calling `.get()`.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
