This is an automated email from the ASF dual-hosted git repository. anmolnar pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/zookeeper.git
commit cfaf837f2319da114bf607809c32bb1b2c699c74 Author: Andor Molnar <[email protected]> AuthorDate: Thu Jul 9 12:27:13 2026 -0500 Missing ACL check in setWatches() on reconnect --- .../java/org/apache/zookeeper/server/DataTree.java | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java index 1f93f18c7..20402156f 100644 --- a/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java +++ b/zookeeper-server/src/main/java/org/apache/zookeeper/server/DataTree.java @@ -1489,9 +1489,9 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String> for (String path : dataWatches) { DataNode node = getNode(path); if (node == null) { - watcher.process(new WatchedEvent(EventType.NodeDeleted, KeeperState.SyncConnected, path)); + processWatchEvent(watcher, new WatchedEvent(EventType.NodeDeleted, KeeperState.SyncConnected, path), null); } else if (node.stat.getMzxid() > relativeZxid) { - watcher.process(new WatchedEvent(EventType.NodeDataChanged, KeeperState.SyncConnected, path)); + processWatchEvent(watcher, new WatchedEvent(EventType.NodeDataChanged, KeeperState.SyncConnected, path), new ArrayList<>(getACL(node))); } else { this.dataWatches.addWatch(path, watcher); } @@ -1499,7 +1499,7 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String> for (String path : existWatches) { DataNode node = getNode(path); if (node != null) { - watcher.process(new WatchedEvent(EventType.NodeCreated, KeeperState.SyncConnected, path)); + processWatchEvent(watcher, new WatchedEvent(EventType.NodeCreated, KeeperState.SyncConnected, path), new ArrayList<>(getACL(node))); } else { this.dataWatches.addWatch(path, watcher); } @@ -1507,9 +1507,9 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String> for (String path : childWatches) { DataNode node = getNode(path); if (node == null) { - watcher.process(new WatchedEvent(EventType.NodeDeleted, KeeperState.SyncConnected, path)); + processWatchEvent(watcher, new WatchedEvent(EventType.NodeDeleted, KeeperState.SyncConnected, path), null); } else if (node.stat.getPzxid() > relativeZxid) { - watcher.process(new WatchedEvent(EventType.NodeChildrenChanged, KeeperState.SyncConnected, path)); + processWatchEvent(watcher, new WatchedEvent(EventType.NodeChildrenChanged, KeeperState.SyncConnected, path), new ArrayList<>(getACL(node))); } else { this.childWatches.addWatch(path, watcher); } @@ -1523,6 +1523,18 @@ public void setWatches(long relativeZxid, List<String> dataWatches, List<String> } } + /** + * Route replayed events through the ACL-aware overload so they get the same + * READ check as WatchManager.triggerWatch; acl is null for a deleted node. + */ + private void processWatchEvent(Watcher watcher, WatchedEvent event, List<ACL> acl) { + if (watcher instanceof ServerWatcher) { + ((ServerWatcher) watcher).process(event, acl); + } else { + watcher.process(event); + } + } + /** * This method sets the Cversion and Pzxid for the specified node to the * values passed as arguments. The values are modified only if newCversion
