[
https://issues.apache.org/jira/browse/JCRVLT-85?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Konrad Windszus updated JCRVLT-85:
----------------------------------
Description:
There are two issue with conflicting IDs:
# {{DocViewSAXImporter.addNode(DocViewNode)}} checks if an ID set in the node
which is about to be imported to the JCR is already taken
(https://github.com/apache/jackrabbit-filevault/blob/trunk/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewSAXImporter.java#L777).
Unfortunately this check will completely skip the import if the conflicting
node is a sibling of the to-be-imported node
# Since between the check for the conflicting node id and the actual import in
{{DocViewSAXImporter.createNode(DocViewNode)}} there might be other JCR
operations happening leading to a conflicting node the import behaviour set in
https://github.com/apache/jackrabbit-filevault/blob/trunk/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewSAXImporter.java#L979
might still matter in edge cases.
Currently it is using the
{{ImportUUIDBehavior.IMPORT_UUID_COLLISION_REMOVE_EXISTING}}.
According to the JCR Spec
(http://www.day.com/specs/jcr/2.0/11_Import.html#11.8.2%20Remove%20Existing%20Node)
that means the node with the same ID is first removed from the repo (no matter
where it is located), then the new node one is imported with that ID.
That is a problem, if by coincidence the ID 1 is used for node /content/a in
the repository and now you install a package containing /content/b also having
the ID 1. Then the package would remove the /content/a node from the
repository, although this is not intended. I would rather recommend using
{{ImportUUIDBehavior.IMPORT_UUID_COLLISION_THROW}}.
was:
Currently the DocViewSaxImporter is using the
{{ImportUUIDBehavior.IMPORT_UUID_COLLISION_REMOVE_EXISTING}}
(https://github.com/apache/jackrabbit-filevault/blob/trunk/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewSAXImporter.java#L1010).
According to the JCR Spec
(http://www.day.com/specs/jcr/2.0/11_Import.html#11.8.2%20Remove%20Existing%20Node)
that means the node with the same ID is first removed from the repo (no matter
where it is located), then the new node one is imported with that ID.
That is a problem, if by coincidence the ID 1 is used for node /content/a in
the repository and now you install a package containing /content/b also having
the ID 1.
Then the package would remove the /content/a node from the repository, although
this is not intended.
> Import behaviour not always correct in case of conflicting node IDs
> -------------------------------------------------------------------
>
> Key: JCRVLT-85
> URL: https://issues.apache.org/jira/browse/JCRVLT-85
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Components: Packaging
> Affects Versions: 3.1.16
> Reporter: Konrad Windszus
>
> There are two issue with conflicting IDs:
> # {{DocViewSAXImporter.addNode(DocViewNode)}} checks if an ID set in the node
> which is about to be imported to the JCR is already taken
> (https://github.com/apache/jackrabbit-filevault/blob/trunk/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewSAXImporter.java#L777).
> Unfortunately this check will completely skip the import if the conflicting
> node is a sibling of the to-be-imported node
> # Since between the check for the conflicting node id and the actual import
> in {{DocViewSAXImporter.createNode(DocViewNode)}} there might be other JCR
> operations happening leading to a conflicting node the import behaviour set
> in
> https://github.com/apache/jackrabbit-filevault/blob/trunk/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewSAXImporter.java#L979
> might still matter in edge cases.
> Currently it is using the
> {{ImportUUIDBehavior.IMPORT_UUID_COLLISION_REMOVE_EXISTING}}.
> According to the JCR Spec
> (http://www.day.com/specs/jcr/2.0/11_Import.html#11.8.2%20Remove%20Existing%20Node)
> that means the node with the same ID is first removed from the repo (no
> matter where it is located), then the new node one is imported with that ID.
> That is a problem, if by coincidence the ID 1 is used for node /content/a in
> the repository and now you install a package containing /content/b also
> having the ID 1. Then the package would remove the /content/a node from the
> repository, although this is not intended. I would rather recommend using
> {{ImportUUIDBehavior.IMPORT_UUID_COLLISION_THROW}}.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
