Aias00 opened a new issue, #7467: URL: https://github.com/apache/shenyu/issues/7467
## Description `POST /proxy-selector/addProxySelector` accepts a `ProxySelectorAddDTO` with a nested `discovery.id`, but the id is not validated against the target namespace before the proxy selector is inserted. The controller accepts the DTO at `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ProxySelectorController.java:107`. The DTO validates only that `discovery` is present and that `namespaceId` exists (`shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/ProxySelectorAddDTO.java:86`, `:97`); the nested `Discovery.id` field at `ProxySelectorAddDTO.java:325` has no existence or namespace check. In `ProxySelectorServiceImpl.create`, the proxy selector row is inserted first (`shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:238`). If `discovery.id` is supplied, the service loads it with `discoveryMapper.selectById()` (`ProxySelectorServiceImpl.java:243`) and only checks whether a row exists (`ProxySelectorServiceImpl.java:246`). The mapper query filters only by id, not namespace (`shenyu-admin/src/main/resources/mappers/discovery-sqlmap.xml:53`). When no row exists, `fillDiscovery` is false, related handler/relation/upstream rows are skipped, and the method still returns `CREATE_SUCCESS` at `ProxySelectorServiceImpl.java:283`. When the id belongs to another namespace, the service creates a handler/relation for the new proxy selector using that foreign discovery id (`ProxySelectorServiceImpl.java:253-280`). The binding path has the same validation gap. `bindingDiscoveryHandler()` accepts the supplied `discovery.id` at `ProxySelectorServiceImpl.java:335` and writes the handler/relation without loading the discovery row or checking its namespace (`ProxySelectorServiceImpl.java:342-361`). ## Trigger Call `POST /proxy-selector/addProxySelector` or the binding flow with a DTO whose `namespaceId` is namespace A and whose `discovery.id` is either nonexistent or belongs to namespace B. ## Expected behavior The request should be rejected before any proxy selector or relation is inserted unless the supplied discovery row exists and belongs to the same namespace/plugin/type as the proxy selector being created or bound. ## Actual behavior For a nonexistent id, the proxy selector row is inserted and the method reports success, but no discovery handler/relation/upstream is created. For a cross-namespace id, the handler/relation can point a namespace-A proxy selector at a namespace-B discovery row. ## Impact This leaves the admin database with orphan proxy selectors or cross-namespace discovery topology. Later sync/list/upstream refresh code can skip those rows or assemble data for the wrong namespace, making the proxy selector appear successfully created while it is not usable by the gateway. ## Suggested fix Validate `discovery.id` before inserting or binding: - load the discovery row by id and target namespace, or load by id and compare `namespaceId`; - reject missing or cross-namespace ids with a validation error; - validate plugin/type/level compatibility with the proxy selector path; - perform the same check in `bindingDiscoveryHandler()`; - insert the proxy selector only after the related discovery input is known to be valid. ## Related existing issues This is distinct from #6517 and #6701, which cover proxy selector update NPEs. It is also distinct from #6466, which covers invalid `discoveryHandlerId` in discovery upstream rows, and from #6826, which covers selector cross-namespace deletion. This issue is specifically about proxy selector create/binding accepting invalid or cross-namespace `discovery.id`. ## Reviewed Revision And Validation Apache ShenYu 2.7.2-SNAPSHOT, master at a89b6a2338c24e978428b731e8f1edce86022418. Severity: medium. Confidence: high. Independent actual-service tests reproduced foreign/missing discovery handling using valid mocked persistence fixtures. Current source references: - `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ProxySelectorController.java:107` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/ProxySelectorAddDTO.java:86` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/model/dto/ProxySelectorAddDTO.java:325` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:238` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:243` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:253` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:329` - `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ProxySelectorServiceImpl.java:335` - `shenyu-admin/src/main/resources/mappers/discovery-sqlmap.xml:53` No implementation fix or full deployed end-to-end validation was performed by this review. Source-flow and runtime evidence are distinguished above. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
