Description
When rewriteHandle.getReplace() contains {, the code enters the placeholder-substitution branch: PathMatchUtils.replaceAll(replace, regex.substring(regex.indexOf("{")), rewriteUri.substring(regex.indexOf("{") + 1)). (1) Off-by-one: regex.indexOf("{") is the position of { in the regex, which in the URI corresponds to the first character of the path-variable value (regex and URI share the same prefix up to the {). The +1 skips that first character. E.g. regex=/http/findById/{id} (indexOf("{")=15), URI=/http/findById/123, substring(16)=23 instead of 123. (2) StringIndexOutOfBoundsException: if replace contains { but regex does not, regex.indexOf("{") returns -1, regex.substring(-1) throws. Neither failure mode is covered by tests.
Location
shenyu-plugin/shenyu-plugin-rewrite/src/main/java/org/apache/shenyu/plugin/rewrite/RewritePlugin.java:77-79
Impact
(1) Silent wrong upstream path for every request using path-variable rewrite templates — upstream receives a truncated path segment, likely 404 or wrong resource. (2) 500 on every request when replace template has { but regex is a plain regex without {.
Suggested fix
Change rewriteUri.substring(rewriteHandle.getRegex().indexOf("{") + 1) to rewriteUri.substring(rewriteHandle.getRegex().indexOf("{")) (remove +1). Guard the entire branch with a check that regex.indexOf("{") >= 0.
Related existing
None — distinct from #6805 (RewriteHandle equals/hashCode omit percentage) which is about the DTO's equals/hashCode, not the rewrite logic.
Description
When
rewriteHandle.getReplace()contains{, the code enters the placeholder-substitution branch:PathMatchUtils.replaceAll(replace, regex.substring(regex.indexOf("{")), rewriteUri.substring(regex.indexOf("{") + 1)). (1) Off-by-one:regex.indexOf("{")is the position of{in the regex, which in the URI corresponds to the first character of the path-variable value (regex and URI share the same prefix up to the{). The+1skips that first character. E.g. regex=/http/findById/{id}(indexOf("{")=15), URI=/http/findById/123,substring(16)=23instead of123. (2)StringIndexOutOfBoundsException: ifreplacecontains{butregexdoes not,regex.indexOf("{")returns -1,regex.substring(-1)throws. Neither failure mode is covered by tests.Location
shenyu-plugin/shenyu-plugin-rewrite/src/main/java/org/apache/shenyu/plugin/rewrite/RewritePlugin.java:77-79Impact
(1) Silent wrong upstream path for every request using path-variable rewrite templates — upstream receives a truncated path segment, likely 404 or wrong resource. (2) 500 on every request when replace template has
{but regex is a plain regex without{.Suggested fix
Change
rewriteUri.substring(rewriteHandle.getRegex().indexOf("{") + 1)torewriteUri.substring(rewriteHandle.getRegex().indexOf("{"))(remove+1). Guard the entire branch with a check thatregex.indexOf("{") >= 0.Related existing
None — distinct from #6805 (RewriteHandle equals/hashCode omit percentage) which is about the DTO's equals/hashCode, not the rewrite logic.