Aias00 opened a new issue, #7764: URL: https://github.com/apache/shenyu/issues/7764
## Problem `InstanceController.beat` uses `@Valid`, but `InstanceBeatInfoDTO` has no identity validation constraints. `InstanceCheckService` accepts a report with an empty IP. During persistence, `selectOneByQuery` omits the IP predicate for an empty value. `createOrUpdate` can then select an existing row by the remaining fields and overwrite its IP with the empty value. This is input/data-integrity behavior, not a claim of authentication bypass. The observed path uses an otherwise valid namespace, port and instance type. ## Verified reproduction Baseline `66d7d954ca37d651a5ad916f988a8081157a7ab4`, Java 17. Current DTO/checker/service/entity/VO/mapper were recompiled; the database probe used the current H2 table DDL and real MyBatis XML mapper. 1. Insert one valid `repro / 127.0.0.1 / 9195 / bootstrap` instance. 2. Build a report with the same namespace/port/type but IP `""`. 3. Actual Jakarta Bean Validation returns zero violations for that DTO. 4. Pass it through the real `handleBeatInfo` and `syncDB` methods. 5. Query the database: there is still one row, but its original valid IP has been overwritten with `""`. All probe assertions passed. No HTTP request/controller deployment was executed, so MVC-level behavior still needs a regression test. ## Evidence - [Controller validation boundary](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/InstanceController.java#L115) - [Protocol DTO without constraints](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-register-center/shenyu-register-protocol/src/main/java/org/apache/shenyu/register/common/dto/InstanceBeatInfoDTO.java#L20) - [Optional lookup predicates](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-admin/src/main/resources/mappers/instance-info-sqlmap.xml#L111) - [Lookup followed by unconditional field replacement](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/InstanceInfoServiceImpl.java#L53) ## Acceptance criteria - [ ] Reject incomplete/invalid identity before updating the live map or database; choose an Admin-boundary validation mechanism that respects protocol-module dependency boundaries. - [ ] Persistence lookups that identify an existing instance require all canonical identity components and use exact predicates; do not reuse optional search semantics for an upsert identity. - [ ] Controller tests reject empty/missing identity with a clear client error and no cache/mapper mutation. - [ ] Service/mapper integration tests confirm malformed reports cannot modify an unrelated valid row, including whitespace and missing components. - [ ] Cover internal WebSocket/HTTP/event report paths so they cannot bypass the shared identity invariant; retain explicit legacy protocol compatibility where required. - [ ] Keep optional machine metadata separate from required instance identity and test namespace isolation. Related: #7733 handles concurrent valid identities; #7696 fixes the type emitted by one producer; #6366 covers independent-client compatibility. None prevents a blank identity from broadening this lookup. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
