shashank created CAMEL-26737:
--------------------------------
Summary: camel-sql - JdbcKeyValueRepository replace and
delete(key, expected) match an expired entry
Key: CAMEL-26737
URL: https://issues.apache.org/jira/browse/CAMEL-26737
Project: Camel
Issue Type: Bug
Components: camel-sql
Reporter: shashank
Assignee: shashank
{{JdbcKeyValueRepository.replace(key, expected, newValue, ttl)}} runs
{{updateIfValueString}} ({{UPDATE CAMEL_KEYVALUE SET ITEM_VALUE = ?, EXPIRES_AT
= ? WHERE ITEM_KEY = ? AND ITEM_VALUE = ?}}) and {{delete(key, expected)}} runs
{{deleteIfValueString}} ({{DELETE ... WHERE ITEM_KEY = ? AND ITEM_VALUE = ?}}).
Neither checks {{EXPIRES_AT}}, so both match an entry whose TTL has passed and
return {{true}}, while {{get}} returns {{null}} for that key and
{{putIfAbsent}} treats it as absent. A compare-and-swap on an expired entry can
therefore succeed and give the entry a new TTL, which brings back a value that
has expired.
This was left out of CAMEL-26708 (apache/camel#29405) because the fix changes
the parameters of the customizable {{updateIfValueString}} /
{{deleteIfValueString}}: users with their own column names must change them
too. No Camel component calls these two methods today; they are part of the
{{KeyValueRepository}} API.
*Expected*: {{replace}} and {{delete(key, expected)}} match only an entry that
has not expired, the same rule as {{get}}.
*Suggested fix*: add {{AND (EXPIRES_AT = 0 OR EXPIRES_AT > ?)}} with the
current time to both statements, and an upgrade guide entry for users who set
their own statements.
*Affected*: main and 4.23.0 (read, not run).
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
