[BUG] MockPlugin NPE when httpStatusCode is null in MockHandle (unboxing null Integer to HttpStatus.valueOf) #6882

Description

When rewriteHandle.getReplace() contains {, the code enters the placeholder-substitution branch: PathMatchUtils.replaceAll(replace, regex.substring(regex.indexOf("{")), rewriteUri.substring(regex.indexOf("{") + 1)). (1) Off-by-one: regex.indexOf("{") is the position of { in the regex, which in the URI corresponds to the first character of the path-variable value (regex and URI share the same prefix up to the {). The +1 skips that first character. E.g. regex=/http/findById/{id} (indexOf("{")=15), URI=/http/findById/123, substring(16)=23 instead of 123. (2) StringIndexOutOfBoundsException: if replace contains { but regex does not, regex.indexOf("{") returns -1, regex.substring(-1) throws. Neither failure mode is covered by tests.

Location

• shenyu-plugin/shenyu-plugin-rewrite/src/main/java/org/apache/shenyu/plugin/rewrite/RewritePlugin.java:77-79

Impact

(1) Silent wrong upstream path for every request using path-variable rewrite templates — upstream receives a truncated path segment, likely 404 or wrong resource. (2) 500 on every request when replace template has { but regex is a plain regex without {.

Suggested fix

Change rewriteUri.substring(rewriteHandle.getRegex().indexOf("{") + 1) to rewriteUri.substring(rewriteHandle.getRegex().indexOf("{")) (remove +1). Guard the entire branch with a check that regex.indexOf("{") >= 0.

Related existing

None — distinct from #6805 (RewriteHandle equals/hashCode omit percentage) which is about the DTO's equals/hashCode, not the rewrite logic.