agrestio / agrest

Server-side Java REST Framework for easy access to data graphs from various backends
https://agrest.io
Apache License 2.0
80 stars 34 forks source link

Cayenne IPathResolver may get "poisoned" by per-request overlayed AgEntities #641

Closed andrus closed 1 year ago

andrus commented 1 year ago

IPathResolver is used by "agrest-cayenne" to map Agrest paths to Cayenne paths. Internally it stores a map of path cache entries each with a reference to an AgEntity. Since the entries are created lazily on-demand, it is conceivable that a per-request AgEntity with a few attributes removed is cached in the resolver.

I was able to reproduce the condition, but none of the user-visible negative effects (e.g. if I turn off "readable" flag on some attributes, they are still present in the overlaid entity, and can participate in path resolution). However it is still dirty. The temporary AgEntity is stuck in cache forever. Also we may be using the wrong converters due to redefined types , etc.

So we need to reimplement IPathResolver using Cayenne metadata only to be immune to Agrest model customizations.