Circular JPA entity references cause infinite recursion when doing a GET on any resource using "Accept" header with "application/schema+json". [DATAREST-751] #1123
Comments
|
Ricardo Pereira da Silva commented it seems this bug is related to https://jira.spring.io/browse/DATAREST-733 and https://jira.spring.io/browse/DATAREST-396 |
|
Oliver Drotbohm commented Not sure the relation really applies as it's different context entirely. Still it's unfortunate. You should actually see a Hope this helps to access the schema in the first place, I'll take care of making sure the resource produces the right response |
|
Ricardo Pereira da Silva commented You're totally right Oliver. I really should not try to ask for a json schema from a resource request, as the docs correctly describe. I've just tried that because I could not see any action links in /profile/books when the accept type is "application/schema+json". So I decide to try this accept value when requesting the resource itself to see if I can get the action links. Is there any way in which I could be able to produce a Json Hyper Schema from a SDR resource, I mean, Does SDR support (or have plans to) the RFC draft in http://tools.ietf.org/html/draft-luff-json-hyper-schema-00 ? Could you point me any direction (guidelines, papers, etc) in which I can be able to contribute to SDR to support that? Thanks! (y):D |
|
Grzegorz Anioł commented Similar issue occurs just with simple entity like this: @Entity
public class User {
@Id
@Column(name="user_id")
@GeneratedValue(strategy=GenerationType.AUTO)
private String id;
private String name;
private String password;
@Version
@Column(nullable=false)
private Integer version = 0;
@LastModifiedDate
@Column(name="last_modification")
private Timestamp lastModification = Timestamp.valueOf(LocalDateTime.now());
public String getId() {
return id;
}
public void setId(String id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public Integer getVersion() {
return version;
}
public void setVersion(Integer version) {
this.version = version;
}
public Timestamp getLastModification() {
return lastModification;
}
}In my case I run GET for /api/users/2 and Accept: application/schema+json In logs there is such callstack: I agree it make no sens to send such request but anyway it seems to be vulnerability. |
spring-projects-issues commentedJan 21, 2016
Ricardo Pereira da Silva opened DATAREST-751 and commented
I have entities for "Book" and "Page" representantion that have bidirecional relationship as follows:
So, with my database initialized, if I try to perform a GET on "http://localhost:8080/books" it works perfectly, but if I perform the same GET with the "Accept" header option equals "application/schema+json" it will cause an infinite recursion like this:
I have created a small application to demonstrate this bug: https://github.com/ricardopsilva/sdr-infinite-recursion-bug.git.
Please, let me know if I can help with anything! :D(y)
Affects: 2.4.2 (Gosling SR2)
Reference URL: https://github.com/ricardopsilva/sdr-infinite-recursion-bug.git
The text was updated successfully, but these errors were encountered: