Aias00 opened a new issue, #7453:
URL: https://github.com/apache/shenyu/issues/7453
## Is there an existing issue for this?
- [x] I searched open and closed issues.
## Current Behavior
An ordinary URL-valued query/body/header argument unexpectedly replaces a
fixed MCP tool endpoint.
For example, configure a search tool with `requestTemplate.url="/search"`
and `argsPosition={"callbackUrl":"query"}`. Passing
`{"callbackUrl":"https://callback.invalid/return"}` selects that value as the
whole target instead of encoding it as a query parameter.
The same behavior occurs for `body`, nested body and `header` mappings.
`RequestConfigHelper.buildPath()` calls `isCompleteUrl()` before parameter
mapping; it scans every mapped input and ignores its configured position. The
full callback also replaces its `ShenyuContext.path` and `realUrl` with the URL
value's path.
## Expected Behavior
URL-valued data must remain in its declared query/body/header position. A
tool configured for `/search` should continue executing `/search`, with the URL
value supplied as ordinary data.
Retain intentional complete-target URL support through an explicit
target-bearing configuration/parameter contract, rather than treating every
URL-valued input as a target.
## Steps To Reproduce
```java
JsonObject positions = new JsonObject();
positions.addProperty("callbackUrl", "query");
JsonObject input = new JsonObject();
input.addProperty("callbackUrl", "https://callback.invalid/return";);
String path = RequestConfigHelper.buildPath("/search", positions, input);
// Actual: https://callback.invalid/return
// Expected: /search?callbackUrl=https%3A%2F%2Fcallback.invalid%2Freturn
```
A separate offline harness invoked the actual `ShenyuToolCallback.call()`
with mock session lookup and an in-memory plugin chain.
Query/body/header/nested-body URL arguments all replaced the configured URI and
changed the routing path. Plain query values and unmapped URL values preserved
`/search`.
## Location And Impact
-
[RequestConfigHelper.java:131](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java#L131):
selects a complete URL before normal argument placement.
-
[RequestConfigHelper.java:159](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/request/RequestConfigHelper.java#L159):
selection ignores mapped position/template role.
-
[ShenyuToolCallback.java:603](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java#L603):
applies the selected target URI.
-
[ShenyuToolCallback.java:687](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java#L687):
changes routing context path.
-
[MCP_TOOL_EXAMPLES_EN.md:494](https://github.com/apache/shenyu/blob/67596c1d228b62da75cd0a0ecb47d0ac5d995384/shenyu-plugin/shenyu-plugin-mcp-server/MCP_TOOL_EXAMPLES_EN.md#L494):
documents parameter position mapping.
Severity: Medium. Confidence: high. Coverage: confirmed functional
mapping/routing behavior.
Valid tools that accept callback URLs, resource URLs or URL-valued
header/body data can call the wrong backend path or fail with an unexpected
route/404. The normal HTTP proxy path still resolves the network destination
from configured upstreams; this issue reports parameter placement and endpoint
correctness.
## Suggested Fix And Regression Tests
Only allow full-target replacement for an explicitly designated target
argument or target URL template. Query/body/header mappings should always
follow their declared positions regardless of value shape.
Add callback-level tests for URL-valued query, body, nested-body and header
inputs; assert unchanged endpoint/context and correct data placement. Retain a
positive test for intentional complete-target URL input.
## Validation And Related Issues
Reviewed `master` at `67596c1d228b62da75cd0a0ecb47d0ac5d995384`
(`2.7.2-SNAPSHOT`). Full callback runtime reproduction and independent
source/helper review confirmed this issue. Existing
`RequestConfigHelperTest,ShenyuToolCallbackTest`: 33 tests passed and do not
cover ordinary URL-valued arguments.
#6472/#7430 fix corruption after an intentional complete URL has been
selected. #7442 concerns merging fixed/generated query components. This issue
concerns selecting an ordinary data argument as the target in the first place.
All reproduction used local mocks and in-memory chains. No network requests
to any URL-valued input or deployed gateway were made.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
