protect notification controller when the input format is invalid

apollo-biz/src/main/java/com/ctrip/framework/apollo/biz/service/ReleaseMessageService.java

@@ -8,8 +8,10 @@ import com.dianping.cat.Cat;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
+import org.springframework.util.CollectionUtils;
 
 import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 
@@ -22,10 +24,16 @@ public class ReleaseMessageService {
   private ReleaseMessageRepository releaseMessageRepository;
 
   public ReleaseMessage findLatestReleaseMessageForMessages(Collection<String> messages) {
+    if (CollectionUtils.isEmpty(messages)) {
+      return null;
+    }
     return releaseMessageRepository.findTopByMessageInOrderByIdDesc(messages);
   }
 
   public List<ReleaseMessage> findLatestReleaseMessagesGroupByMessages(Collection<String> messages) {
+    if (CollectionUtils.isEmpty(messages)) {
+      return Collections.EMPTY_LIST;
+    }
     List<Object[]> result =
         releaseMessageRepository.findLatestReleaseMessagesGroupByMessages(messages);
     List<ReleaseMessage> releaseMessages = Lists.newArrayList();

apollo-configservice/src/main/java/com/ctrip/framework/apollo/configservice/controller/NotificationControllerV2.java

@@ -108,6 +108,10 @@ public class NotificationControllerV2 implements ReleaseMessageListener {
       clientSideNotifications.put(namespace, notification.getNotificationId());
     }
 
+    if (CollectionUtils.isEmpty(namespaces)) {
+      throw new BadRequestException("Invalid format of notifications: " + notificationsAsString);
+    }
+
     Multimap<String, String> watchedKeysMap =
         watchKeysUtil.assembleAllWatchKeys(appId, cluster, namespaces, dataCenter);