fix the potential data inconsistency issue

apolloconfig · Mar 9, 2022 · 4387eb1 · 4387eb1
1 parent 0ae4fc7
commit 4387eb1
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 0 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -44,5 +44,6 @@ Apollo 2.0.0
 * [Using commons-lang3 to replace commons-lang](https://github.com/apolloconfig/apollo/pull/4225)
 * [optimize import/export config](https://github.com/apolloconfig/apollo/pull/4231)
 * [Configure publish and rollback modal boxes to add scrollbars](https://github.com/apolloconfig/apollo/pull/4251)
+* [Fix the potential data inconsistency issue](https://github.com/apolloconfig/apollo/pull/4256)
 ------------------
 All issues and pull requests are [here](https://github.com/ctripcorp/apollo/milestone/8?closed=1)
diff --git a/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/ItemService.java b/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/service/ItemService.java
@@ -96,6 +96,11 @@ public void updateConfigItemByText(NamespaceTextModel model) {
     }
     long namespaceId = namespace.getId();
 
+    // In case someone constructs an attack scenario
+    if (model.getNamespaceId() != namespaceId) {
+      throw new BadRequestException("Invalid request, item and namespace do not match!");
+    }
+
     String configText = model.getConfigText();
 
     ConfigTextResolver resolver =

diff --git a/apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/service/ConfigServiceTest.java b/apollo-portal/src/test/java/com/ctrip/framework/apollo/portal/service/ConfigServiceTest.java
@@ -81,6 +81,7 @@ public void testUpdateConfigByText() {
     model.setAppId(appId);
     model.setConfigText("a=b\nb=c\nc=d\nd=e");
     model.setFormat(ConfigFileFormat.Properties.getValue());
+    model.setNamespaceId(someNamespaceId);
     List<ItemDTO> itemDTOs = mockBaseItemHas3Key();
     ItemChangeSets changeSets = new ItemChangeSets();
     changeSets.addCreateItem(new ItemDTO("d", "c", "", 4));