Aias00 opened a new issue, #7976: URL: https://github.com/apache/shenyu/issues/7976
### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior Rule match results are stored under plugin name and request path, without selector ID. After selecting a selector, AbstractShenyuPlugin accepts the cached rule without checking its selectorId. Therefore, two selectors selected by different request headers can execute each other's rules. ### Expected Behavior A cached rule must belong to the currently selected selector. Isolate entries by selector and path, and ensure negative entries have the same isolation. ### Steps To Reproduce 1. Enable a test plugin using AbstractShenyuPlugin, with default match caches enabled. 2. Add custom-flow selector A: AND `header X-Tenant = a`; add selector B: AND `header X-Tenant = b`. Set both enabled and continued=true. 3. Under A add enabled rule RA: `uri = /x`. Under B add enabled rule RB: `uri = /x`. 4. Execute GET /x with X-Tenant=a. Observed doExecute receives A and RA. 5. Execute GET /x with X-Tenant=b. Observed doExecute receives **B and RA**, instead of B and RB. The header-based selectors are not positively cached, but their URI-only rules are. Thus selector selection is correct while rule selection crosses the selector boundary. This can apply the wrong route, transformation or policy handle, depending on the plugin. ### Anything else? - Rule lookup: https://github.com/apache/shenyu/blob/862f5e37e894bd8cef85ef540a8629f313e9ecdf/shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/AbstractShenyuPlugin.java#L120-L132 - Cache key: https://github.com/apache/shenyu/blob/862f5e37e894bd8cef85ef540a8629f313e9ecdf/shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/cache/MatchDataCache.java#L175-L178 ### Environment ShenYu master, 2.7.2-SNAPSHOT, commit `862f5e37e894bd8cef85ef540a8629f313e9ecdf`, Java 17. ### Validation Reproduced with a minimal concrete AbstractShenyuPlugin subclass, real BaseDataCache/MatchDataCache, Spring MockServerWebExchange and execute(...).block(). The subclass records selector/rule IDs in doExecute. Match caches use the default enabled settings. The existing 90 targeted matching/cache/predicate tests passed; this does not exercise a deployed HTTP gateway. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
