yuluo-yx opened a new pull request, #7577: URL: https://github.com/apache/shenyu/pull/7577
## Summary Patch the Netty and Spring AI dependency families already used by ShenYu. This is a **standalone security-maintenance PR based on upstream `master`**; it does not include the Connect integration or any commits from #7575. - Import `io.netty:netty-bom:4.1.139.Final` before the Spring Boot BOM. ShenYu imports rather than inherits Spring Boot dependency management, so setting a property alone does not override its imported Netty versions. The earlier Netty BOM keeps all Netty artifacts aligned. - Upgrade the existing Spring AI BOM from `1.1.2` to `1.1.8`. - Add dependency-security regression tests for HTTP chunk framing and Spring AI chat-memory isolation/escaping. - Update MCP compatibility comments and version tables to the version tested here. Both upgrades stay on the existing minor lines: Netty **4.1**, Spring AI **1.1**. Spring Boot remains **3.3.1**, and MCP SDK remains **0.17.0**. No ShenYu production execution logic is changed. ## Vulnerabilities and fixed versions Representative advisories affecting the previously resolved versions: | Dependency / previous version | Advisory | Issue | First patched version on the existing line | Selected version | | --- | --- | --- | --- | --- | | Spring AI `1.1.2` | [CVE-2026-41712 / GHSA-q62f-h9x2-gcqc](https://github.com/advisories/GHSA-q62f-h9x2-gcqc) | Shared default conversation ID can leak chat history between users | `1.1.6` | `1.1.8` | | Spring AI `1.1.2` | [CVE-2026-41713 / GHSA-5852-phmh-8fhr](https://github.com/advisories/GHSA-5852-phmh-8fhr) | Memory poisoning / prompt injection in `PromptChatMemoryAdvisor` | `1.1.6` | `1.1.8` | | Netty `4.1.111.Final` | [CVE-2025-24970 / GHSA-4g8c-wm8x-jfhw](https://github.com/advisories/GHSA-4g8c-wm8x-jfhw) | Malformed TLS input can crash a native SSL engine | `4.1.118.Final` | `4.1.139.Final` | | Netty `4.1.111.Final` | [CVE-2025-55163 / GHSA-prj3-ccx8-p6x4](https://github.com/advisories/GHSA-prj3-ccx8-p6x4) | HTTP/2 MadeYouReset denial of service | `4.1.124.Final` | `4.1.139.Final` | | Netty `4.1.111.Final` | [GHSA-j4mg-hqgv-34qc](https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc) | Request smuggling via whitespace in HTTP chunk sizes | `4.1.138.Final` | `4.1.139.Final` | Upgrading Netty only to `4.1.118.Final` would leave newer advisories unresolved. The [4.1.139.Final release](https://github.com/netty/netty/releases/tag/netty-4.1.139.Final), published October 6, 2026, includes additional security fixes; not all have assigned CVE numbers. [Spring AI 1.1.8](https://github.com/spring-projects/spring-ai/releases/tag/v1.1.8) was published June 12, 2026. A vulnerable dependency version is not proof that every advisory is exploitable in ShenYu. In particular, existing AI plugin production sources do not install Spring AI chat-memory advisors; the new tests protect the resolved dependency contracts. ## Validation — October 13, 2026 ### Build and compatibility Java: Temurin `17.0.19+10`, using the repository Maven wrapper. ```bash selected_projects=":shenyu-plugin-mcp-server,:shenyu-spring-boot-starter-plugin-mcp-server,:shenyu-plugin-httpclient,:shenyu-plugin-response,:shenyu-protocol-tcp,:shenyu-protocol-mqtt,:shenyu-protocol-grpc,:shenyu-plugin-websocket,:shenyu-plugin-grpc,:shenyu-plugin-cryptor,:shenyu-plugin-ai-common,:shenyu-plugin-ai-prompt,:shenyu-plugin-ai-proxy,:shenyu-plugin-ai-request-transformer,:shenyu-plugin-ai-response-transformer,:shenyu-plugin-ai-sensitive-word,:shenyu-plugin-ai-token-limiter,:shenyu-spring-boot-starter-plugin-ai-prompt,:shenyu-spring-boot-starter-plugin-ai-proxy,:shenyu-spring-boot-starter-plugin-ai-request-transformer,:shenyu-spring-boot-starter-plugin-ai-response-transformer,:shenyu-spring-boot-starter-plugin-ai-sensitive-word,:shenyu-spring-boot-starter-plugin-ai-token-limiter" mise exec [email protected]+10 -- ./mvnw -B \ -pl "$selected_projects" -am clean verify \ org.apache.maven.plugins:maven-dependency-plugin:3.8.1:tree \ -Dmaven.javadoc.skip=true -Dscope=runtime -DoutputType=json \ -DoutputFile=target/security-dependencies.json ``` - **42 reactor modules: BUILD SUCCESS**. Covers all AI plugin leaves and their starters, MCP plugin/starter, HTTP client/response, TCP/MQTT/gRPC, WebSocket/gRPC proxy, cryptor, and their dependencies. - Surefire: **1,627 tests recorded; 0 failures; 0 errors; 1 skipped**. - Checkstyle and Apache RAT passed in this reactor; `git diff --check` passed. - Resolved runtime trees confirm **31 distinct Netty artifacts at `4.1.139.Final`** and **8 Spring AI artifacts at `1.1.8`**, with Boot `3.3.1` and MCP SDK `0.17.0` retained. ### Red / green security regression tests | Test class | Baseline Netty `4.1.111.Final` / Spring AI `1.1.2` | Upgraded versions | | --- | --- | --- | | `NettyHttpCodecSecurityRegressionTest` | 3 tests, 2 assertion failures, 0 errors | 3 passed | | `SpringAiSecurityRegressionTest` | 3 tests, 2 assertion failures, 0 errors | 3 passed | The failing baseline cases demonstrate that malformed chunk sizes are not rejected and that missing conversation IDs / injected role tags do not satisfy the new security contracts. Valid chunk extensions and explicitly separated conversations remain accepted. To reproduce the baseline checks (expected assertion failures), run each test class with the old dependency properties: ```bash mise exec [email protected]+10 -- ./mvnw -B \ -pl :shenyu-common -am test \ -Dtest=NettyHttpCodecSecurityRegressionTest \ -Dsurefire.failIfNoSpecifiedTests=false \ -Dnetty.version=4.1.111.Final -Dspring-ai.version=1.1.2 mise exec [email protected]+10 -- ./mvnw -B \ -pl :shenyu-plugin-ai-common -am test \ -Dtest=SpringAiSecurityRegressionTest \ -Dsurefire.failIfNoSpecifiedTests=false \ -Dnetty.version=4.1.111.Final -Dspring-ai.version=1.1.2 ``` ### Dependency audit and remaining risks Queried the [OSV API](https://google.github.io/osv.dev/api/) using the actual runtime dependency trees, not just the POM properties: **118 unique Maven coordinates**, comprising the AI proxy runtime graph plus the resolved Netty/Spring AI families across the selected reactor. All **39 Netty/Spring AI coordinates had no known advisory matches** on the audit date. This is a database snapshot, not a guarantee against undisclosed vulnerabilities. **This PR is not a whole-repository security clean bill.** The unchanged AI proxy runtime dependencies still produce 41 distinct OSV matches (13 high, 1 critical, 23 moderate, 4 low). These are version matches, not verified exploitable paths. Examples cross-checked against GitHub advisories: - `spring-expression:6.1.10`: [CVE-2026-41850](https://github.com/advisories/GHSA-r5w3-xv2f-j59q), high, affects applications evaluating attacker-supplied SpEL. Public patched versions include `6.2.19` / `7.0.8`; no first patched version is listed for the 6.1 range. - `spring-webflux:6.1.10`: [CVE-2026-47892](https://github.com/advisories/GHSA-9qf2-26p9-2q2q), critical database rating, conditional on functional endpoints deployed with `DispatcherServlet`. This audit does **not** establish that deployment condition in ShenYu. The advisory lists `7.0.9` as patched and no first patched 6.1 version. - `jackson-core:2.17.1`: [CVE-2026-89425](https://github.com/advisories/GHSA-7hhh-6rmp-j9qf), high, concerns malformed input through the `DataInput` parser. Patched 2.x examples include `2.18.11` / `2.21.7` / `2.22.3`. - Other version matches remain in Jackson Databind, Micrometer, Reactor Netty, and Spring Retry. Resolving the remaining Spring platform/Jackson families requires separate compatibility work; it is deliberately not mixed into this focused Netty/Spring AI upgrade. **The PR is Draft because the broader no-high-CVE gate is not met.** JaCoCo line coverage: AI proxy **96.34%**. Existing modules including common **66.23%**, AI common **56.74%**, and MCP server **60.52%** remain below the 90% target. No executable ShenYu production lines were added, but this is not a claim of repository-wide 90% coverage. Full-repository `clean install`, Docker integration/E2E, load/performance, capacity, and chaos testing were **not run**. Remote CI is still required. ## Compatibility, migration, and rollback - No ShenYu selector/rule/configuration or database migration: replace the managed dependencies and rebuild. - Downstream customizations using Spring AI memory advisors must supply an explicit, isolated conversation ID. Prefer `MessageChatMemoryAdvisor` over the deprecated prompt-memory advisor; the latter now escapes untrusted memory. - The Netty update intentionally rejects previously tolerated malformed HTTP framing. The release also tightens `FileUpload.setContentType` validation; custom multipart integrations should use valid MIME content types. - MCP SDK is intentionally not upgraded in this PR. Local MCP and AI module tests passed with the existing SDK and Boot versions, but live provider/MCP deployment compatibility still needs integration validation. - Rollback: revert this PR's single commit and rebuild. This restores the vulnerable dependency versions and should only be an emergency measure. ## Contributor checklist - [x] I have read the [contribution guidelines](https://shenyu.apache.org/community/contributor-guide). - [x] Test cases back the changes. - [ ] Full local `./mvnw clean install -Dmaven.javadoc.skip=true` passed (the targeted 42-module `clean verify` above passed; full repository build was not run). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
