[
https://issues.apache.org/jira/browse/CAMEL-26737?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-26737.
---------------------------------
Resolution: Fixed
> camel-sql - JdbcKeyValueRepository replace and delete(key, expected) match an
> expired entry
> -------------------------------------------------------------------------------------------
>
> Key: CAMEL-26737
> URL: https://issues.apache.org/jira/browse/CAMEL-26737
> Project: Camel
> Issue Type: Bug
> Components: camel-sql
> Reporter: shashank
> Assignee: shashank
> Priority: Minor
> Fix For: 4.24.0
>
>
> {{JdbcKeyValueRepository.replace(key, expected, newValue, ttl)}} runs
> {{updateIfValueString}} ({{UPDATE CAMEL_KEYVALUE SET ITEM_VALUE = ?,
> EXPIRES_AT = ? WHERE ITEM_KEY = ? AND ITEM_VALUE = ?}}) and {{delete(key,
> expected)}} runs {{deleteIfValueString}} ({{DELETE ... WHERE ITEM_KEY = ? AND
> ITEM_VALUE = ?}}). Neither checks {{EXPIRES_AT}}, so both match an entry
> whose TTL has passed and return {{true}}, while {{get}} returns {{null}} for
> that key and {{putIfAbsent}} treats it as absent. A compare-and-swap on an
> expired entry can therefore succeed and give the entry a new TTL, which
> brings back a value that has expired.
> This was left out of CAMEL-26708 (apache/camel#29405) because the fix changes
> the parameters of the customizable {{updateIfValueString}} /
> {{deleteIfValueString}}: users with their own column names must change them
> too. No Camel component calls these two methods today; they are part of the
> {{KeyValueRepository}} API.
> *Expected*: {{replace}} and {{delete(key, expected)}} match only an entry
> that has not expired, the same rule as {{get}}.
> *Suggested fix*: add {{AND (EXPIRES_AT = 0 OR EXPIRES_AT > ?)}} with the
> current time to both statements, and an upgrade guide entry for users who set
> their own statements.
> *Affected*: main and 4.23.0 (read, not run).
> _Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
