Aias00 opened a new issue, #7442:
URL: https://github.com/apache/shenyu/issues/7442
## Is there an existing issue for this?
- [x] I searched existing open and closed issues.
## Current Behavior
MCP `RequestConfigHelper.buildPath()` constructs a malformed target when the
configured URL already has a query string and the tool input contributes a
query argument.
For template `/users?fixed=true`, `argsPosition={"page":"query"}`, and input
`{"page":"1"}`, the current output is:
```text
/users&page=1&fixed=true
```
`URI.create(output).getQuery()` is `null`; both parameters have become part
of the path.
`buildPath()` first removes the template's query separator to obtain
`basePath`. `buildFinalPath()` then appends `&` for the first generated query
argument because `hasExistingQuery` is true, even though the output no longer
contains `?`. The tool callback consumes this path as its request target.
## Expected Behavior
Preserve the configured endpoint and both query parameters, for example
`/users?fixed=true&page=1` or `/users?page=1&fixed=true`.
## Steps To Reproduce
Run against the current helper:
```java
JsonObject positions = new JsonObject();
positions.addProperty("page", "query");
JsonObject input = new JsonObject();
input.addProperty("page", "1");
String actual = RequestConfigHelper.buildPath("/users?fixed=true",
positions, input);
System.out.println(actual); // /users&page=1&fixed=true
System.out.println(URI.create(actual).getQuery()); // null
```
An MCP tool configured with these values therefore forwards the request to
an unintended path instead of supplying the query parameters.
## Environment
ShenYu `2.7.2-SNAPSHOT`, `master` at
`67596c1d228b62da75cd0a0ecb47d0ac5d995384`, Java 17.
## Location And Impact
-
[RequestConfigHelper.java:138](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java#L138):
separates base path and existing query.
-
[RequestConfigHelper.java:248](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java#L248):
appends `&` without a preceding `?`.
-
[ShenyuToolCallback.java:383](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java#L383):
consumes the constructed target.
Severity: Medium. Confidence: high. Tools using fixed endpoint query
parameters together with dynamic query arguments can receive a backend 404 or
incorrect backend behavior.
## Suggested Fix And Regression Coverage
Construct the combined query independently and add exactly one `?` before
the first component, with `&` only between components. Cover existing-only,
generated-only, combined, and empty existing query cases, including encoded
values. Preserve both fixed and generated parameters without losing the
endpoint path.
## Validation And Related Issues
Compiled the current `RequestConfigHelper.java` and ran the above
reproduction successfully; the malformed output and null query were observed.
Existing helper tests cover generated query parameters but lack the combined
fixed/generated case.
Targeted `RequestConfigHelperTest,ShenyuToolCallbackTest` execution passed
33 tests with zero failures.
#6751 concerns encoding path/query values. #6472 and #7430 concern complete
URL targets being prefixed with the gateway URL. This issue is about the
missing query separator when merging existing and generated query components,
and remains reproducible after those fixes.
No full MCP/gateway deployment was run.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
