Aias00 opened a new issue, #3537:
URL: https://github.com/apache/dubbo-go/issues/3537
### Problem
`MetadataServiceV2.GetMetadataInfo` dereferences the result of
`delegate.GetMetadataInfo` without a nil check, but
`DefaultMetadataService.GetMetadataInfo` returns `(nil, nil)` for an empty
revision **and** for any revision not present in the local `metadataMap`:
```go
// metadata/metadata_service.go
func (mts *DefaultMetadataService) GetMetadataInfo(revision string)
(*info.MetadataInfo, error) {
if revision == "" {
return nil, nil
}
...
for _, metadataInfo := range mts.metadataMap {
if metadataInfo.Revision == revision { return metadataInfo, nil }
}
logger.Warnf("[Metadata] metadata not found for revision=%s", revision)
return nil, nil
}
func (mtsV2 *MetadataServiceV2) GetMetadataInfo(ctx context.Context, req
*tripleapi.MetadataRequest) (*tripleapi.MetadataInfoV2, error) {
metadataInfo, err := mtsV2.delegate.GetMetadataInfo(req.GetRevision())
if err != nil { return nil, err }
return &tripleapi.MetadataInfoV2{
App: metadataInfo.App, // nil deref
Version: metadataInfo.Revision, // nil deref
Services: convertV2(metadataInfo.GetServices()),
Tag: metadataInfo.Tag,
}, err
}
```
The `MetadataServiceV2Handler` is exported over Triple
(`MetadataServiceV2_ServiceInfo`), so `getMetadataInfo` is remotely reachable:
a consumer requesting a revision the provider does not have locally
(not-yet-published, stale, or a wrong revision) crashes the triple handler
goroutine.
### Current behavior
A `getMetadataInfo` triple call with a revision the provider does not have →
`delegate.GetMetadataInfo` returns `(nil, nil)` → `metadataInfo.App`
nil-pointer panic → provider-side goroutine crash / DoS on the metadata
endpoint.
### Expected behavior
An unknown revision should return a clear error instead of panicking.
### Suggested approach
```go
metadataInfo, err := mtsV2.delegate.GetMetadataInfo(req.GetRevision())
if err != nil { return nil, err }
if metadataInfo == nil {
return nil, perrors.Errorf("metadata info not found for revision=%s",
req.GetRevision())
}
```
### Acceptance criteria
- [ ] `GetMetadataInfo` with an unknown/empty revision returns an error, no
panic.
- [ ] Regression test covers the nil-delegate-return path (empty
`metadataMap`).
- [ ] Existing `TestMetadataServiceV2GetMetadataInfoPreservesTag` remains
green.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
