Description
The discovery table has a namespace_id column (projected by the join select at discovery-sqlmap.xml:111, written by insert), but update, updateSelective, and delete all end WHERE id = #{id} with no namespace_id predicate. DiscoveryServiceImpl.delete(String discoveryId) takes only discoveryId (no namespace param at all); update builds a DO with .namespaceId(...) but updateSelective WHERE is id-only, so the supplied namespace is silently ignored. DiscoveryController (@RestApi) exposes POST /discovery/insertOrUpdate and DELETE /discovery/{discoveryId} with no per-method permission annotation.
Location
shenyu-admin/src/main/resources/mappers/discovery-sqlmap.xml:207-218 (update), 220-249 (updateSelective), 251-255 (delete)shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryServiceImpl.java:191-203,231-246shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/DiscoveryController.java:36-88
Impact
A user who knows/guesses a discovery id can update or delete a discovery config in another namespace, breaking namespace isolation for the discovery topology.
Suggested fix
Add AND namespace_id = #{namespaceId, jdbcType=VARCHAR} to the WHERE clauses of update, updateSelective, and delete; pass the DO's namespaceId; add a namespace parameter to the delete controller; add a permission annotation.
Related existing
Distinct from N8 (#6615, DiscoveryController missing @RequiresPermissions) and N15 (publish-before-commit in registerDiscoveryConfig) — this is the missing-namespace-in-WHERE defect in the update/delete mapper statements.
Description
The
discoverytable has anamespace_idcolumn (projected by the join select atdiscovery-sqlmap.xml:111, written byinsert), butupdate,updateSelective, anddeleteall endWHERE id = #{id}with nonamespace_idpredicate.DiscoveryServiceImpl.delete(String discoveryId)takes onlydiscoveryId(no namespace param at all);updatebuilds a DO with.namespaceId(...)butupdateSelectiveWHERE is id-only, so the supplied namespace is silently ignored.DiscoveryController(@RestApi) exposesPOST /discovery/insertOrUpdateandDELETE /discovery/{discoveryId}with no per-method permission annotation.Location
shenyu-admin/src/main/resources/mappers/discovery-sqlmap.xml:207-218(update),220-249(updateSelective),251-255(delete)shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryServiceImpl.java:191-203,231-246shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/DiscoveryController.java:36-88Impact
A user who knows/guesses a discovery
idcan update or delete a discovery config in another namespace, breaking namespace isolation for the discovery topology.Suggested fix
Add
AND namespace_id = #{namespaceId, jdbcType=VARCHAR}to the WHERE clauses ofupdate,updateSelective, anddelete; pass the DO's namespaceId; add a namespace parameter to the delete controller; add a permission annotation.Related existing
Distinct from N8 (#6615,
DiscoveryControllermissing@RequiresPermissions) and N15 (publish-before-commit inregisterDiscoveryConfig) — this is the missing-namespace-in-WHERE defect in the update/delete mapper statements.