[BUG] Spring SDK path-variable values are interpreted as regex replacement syntax #7712

Current behavior

PathVariableParameterProcessor feeds string/map values directly to RegExUtils.replaceAll() as replacement strings. Java replacement syntax interprets $n, ${name} and backslashes instead of treating the path-variable value as literal text.

Location / reachable flow

PathVariableParameterProcessor.java:50–66.

The processor is invoked by ShenyuClientMethodHandler.targetProcessor() before executing the HTTP transport. Both the single-string and map branches have the same unquoted replacement behavior.

Trigger and validation

Define an SDK endpoint /files/{name}, then pass a value containing $1 or a backslash. A standalone probe compiled the current processor, obtained a real @PathVariable("name") annotation from a method, and applied the actual processor:

PATH_VALUE=plain OUTPUT=http://localhost/files/plain
PATH_VALUE=$1 EXCEPTION=java.lang.IndexOutOfBoundsException: No group 1
PATH_VALUE=a\b OUTPUT=http://localhost/files/ab

An independent reviewer confirmed the same behavior in both replacement branches. The probe executes URL construction rather than a live HTTP request.

Impact / expected behavior

Valid application identifiers containing a dollar sign can prevent request construction, while backslash-containing values can be silently changed. This is a literal-substitution defect separate from deciding how path-segment characters should be percent-encoded.

Suggested fix

Use a literal placeholder replacement operation, or quote regex patterns and replacement values appropriately (Matcher.quoteReplacement for values). Apply the SDK's intended path-segment encoding policy separately so replacement quoting and URI encoding are not conflated.

Related existing work

#7465 concerns Spring annotation name aliases; #7464 concerns query-parameter URL encoding; #6489 concerns mixing path/query parameters. Live PathVariableParameterProcessor and historical SDK searches did not identify this replacement-syntax issue.

Reviewed revision

Apache ShenYu 2.7.2-SNAPSHOT, master@66d7d954ca37d651a5ad916f988a8081157a7ab4. Severity Medium / P2; confidence high. Unit-test and CI issue categories excluded.