AlexStocks opened a new issue, #3566:
URL: https://github.com/apache/dubbo-go/issues/3566
## Motivation
During a code-quality audit of this repo (driven by `CODE_REVIEW_GUIDE.md`
v1.0 and
`security-review-2026-07-30.md`), several gaps between the documented
process and the
actual code/process were found. This issue tracks them as actionable items
so they can be
driven one by one.
## Items
### 1. ๐ด Script router DoS โ missing execution timeout (Blocker)
- **Location**: `cluster/router/script/instance/js_instance.go`.
`runScript()` executes `j.rt.RunProgram(pg)` without any interrupt
deadline, and
`initCallArgs()` only calls `j.rt.ClearInterrupt()` (which clears an
existing interrupt
but never sets one).
- **Risk**: a script that loops forever (e.g. `while (true) {}`) blocks the
handling
goroutine indefinitely โ denial of service. (Ref: `CODE_REVIEW_GUIDE.md`
ยง4.2.2)
- **Fix direction**: wrap `RunProgram` with `time.AfterFunc` that calls
`j.rt.Interrupt(...)`, plus `defer timer.Stop()`. A `-race` test should
guard it.
### 2. ๐ก CODEOWNERS are placeholder handles
- `CODEOWNERS` uses virtual handles (`@dubbo-go/cluster-maintainers`, etc.)
that do not
resolve, so GitHub never routes review requests. Replace them with real
teams/committers
so PR review assignment actually works (the exact risk warned in
`CODE_REVIEW_GUIDE.md` ยง1).
### 3. ๐ก Test-coverage gaps in high-risk concurrent modules
- `global/` 25 source files โ 1 test file; `common/` 55 โ 11; `cluster/` 95
โ 28.
These are concurrency-heavy modules. Add core-path and `-race` tests, and
consider a
codecov floor to stop the gaps from widening.
## Plan
- [ ] Fix script-router execution timeout + add `-race` test (PR)
- [ ] Replace CODEOWNERS placeholders with real owners
- [ ] Add tests for `global/` and `common/` core paths + `-race`
- [ ] (Optional) Recurring review-clinic using real PRs as teaching material
Will drive these item-by-item and link the PRs back here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
