Aias00 opened a new issue, #6714: URL: https://github.com/apache/shenyu/issues/6714
- severity: Medium - files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SwaggerImportServiceImpl.java:121-145,129`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/SwaggerImportRequest.java:38` - description: `importSwagger` uses `request.getProjectName()` and `request.getSwaggerUrl()` (both `@NotBlank`), but `importMcpConfig` passes `request.getNamespaceId()` (line 129) into `buildMcpToolRegisterDTO(...)` and `buildMetaDataRegisterDTO(...)`. `SwaggerImportRequest.namespaceId` has no `@NotBlank` constraint, and unlike the `/shenyu-client/register-mcp` controller path (which defaults null namespaceId to `Constants.SYS_DEFAULT_NAMESPACE_ID`), this import path calls `shenyuClientRegisterMcpService.registerMcpTools(...)` directly, bypassing that default. A null `namespaceId` is published to the MCP metadata pipeline. - impact: A swagger/MCP import request without `namespaceId` registers MCP tools/meta-data with a null namespace, which can be silently mis-scoped or fail downstream. - suggested_fix: Either add `@NotBlank` to `SwaggerImportRequest.namespaceId` or default it to `Constants.SYS_DEFAULT_NAMESPACE_ID` inside `importMcpConfig`. - confidence: High - related_existing: none. --- _Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
