Root cause: GlobalProvenanceTracker::pickup() actually does return a fully populated list -- but GlobalProvenanceTracker::cull() is called right after it, and that clears the same list, making it appear to have never contained anything.
This is not an issue in the original ProvenanceInfoPickupServlet here in this repo, since that encodes the list before calling cull() -- but it did affect a new provenance pickup endpoint I wrote for a Spring Boot app. Modifying returned lists after the fact is a footgun in general, so best to fix it here.
Wrapping pickup()'s return value in List.copyOf() fixes the issue. PR incoming.
Root cause:
GlobalProvenanceTracker::pickup()actually does return a fully populated list -- butGlobalProvenanceTracker::cull()is called right after it, and that clears the same list, making it appear to have never contained anything.This is not an issue in the original
ProvenanceInfoPickupServlethere in this repo, since that encodes the list before callingcull()-- but it did affect a new provenance pickup endpoint I wrote for a Spring Boot app. Modifying returned lists after the fact is a footgun in general, so best to fix it here.Wrapping
pickup()'s return value inList.copyOf()fixes the issue. PR incoming.