Aias00 opened a new issue, #7712:
URL: https://github.com/apache/shenyu/issues/7712
### Current behavior
`PathVariableParameterProcessor` feeds string/map values directly to
`RegExUtils.replaceAll()` as replacement strings. Java replacement syntax
interprets `$n`, `${name}` and backslashes instead of treating the
path-variable value as literal text.
### Location / reachable flow
[PathVariableParameterProcessor.java:50–66](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-sdk/shenyu-sdk-spring/src/main/java/org/apache/shenyu/sdk/spring/annotation/PathVariableParameterProcessor.java#L50).
The processor is invoked by `ShenyuClientMethodHandler.targetProcessor()`
before executing the HTTP transport. Both the single-string and map branches
have the same unquoted replacement behavior.
### Trigger and validation
Define an SDK endpoint `/files/{name}`, then pass a value containing `$1` or
a backslash. A standalone probe compiled the current processor, obtained a real
`@PathVariable("name")` annotation from a method, and applied the actual
processor:
```text
PATH_VALUE=plain OUTPUT=http://localhost/files/plain
PATH_VALUE=$1 EXCEPTION=java.lang.IndexOutOfBoundsException: No group 1
PATH_VALUE=a\b OUTPUT=http://localhost/files/ab
```
An independent reviewer confirmed the same behavior in both replacement
branches. The probe executes URL construction rather than a live HTTP request.
### Impact / expected behavior
Valid application identifiers containing a dollar sign can prevent request
construction, while backslash-containing values can be silently changed. This
is a literal-substitution defect separate from deciding how path-segment
characters should be percent-encoded.
### Suggested fix
Use a literal placeholder replacement operation, or quote regex patterns and
replacement values appropriately (`Matcher.quoteReplacement` for values). Apply
the SDK's intended path-segment encoding policy separately so replacement
quoting and URI encoding are not conflated.
### Related existing work
#7465 concerns Spring annotation name aliases; #7464 concerns
query-parameter URL encoding; #6489 concerns mixing path/query parameters. Live
PathVariableParameterProcessor and historical SDK searches did not identify
this replacement-syntax issue.
### Reviewed revision
Apache ShenYu 2.7.2-SNAPSHOT,
`master@66d7d954ca37d651a5ad916f988a8081157a7ab4`. Severity Medium / P2;
confidence high. Unit-test and CI issue categories excluded.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
