Description
mergeVendors, mergeComponents, and mergeReleases in VendorDatabaseHandler.java and ComponentDatabaseHandler.java do not guard against mergeTargetId and mergeSourceId when they have same ID. When both IDs refer to the same document, the method still runs its normal merge steps (update target, repoint references, delete source) and unconditionally deletes the source at the end, since target and source are the same document, this silently deletes the vendor/component/release the caller intended to keep, while still returning RequestStatus.SUCCESS.
How to reproduce
-
Create a vendor (or component, or release) and note its ID, e.g. V1.
-
Call the merge endpoint/method with the same ID as both target and source:
mergeVendors(mergeTargetId="V1", mergeSourceId="V1", mergeSelection, user)
-
Observe the response: RequestStatus.SUCCESS.
-
Attempt to fetch V1 afterward, it no longer exists.
The same reproduction steps apply to mergeComponents and mergeReleases
Description
mergeVendors,mergeComponents, andmergeReleasesinVendorDatabaseHandler.javaandComponentDatabaseHandler.javado not guard againstmergeTargetIdandmergeSourceIdwhen they have same ID. When both IDs refer to the same document, the method still runs its normal merge steps (update target, repoint references, delete source) and unconditionally deletes the source at the end, since target and source are the same document, this silently deletes the vendor/component/release the caller intended to keep, while still returningRequestStatus.SUCCESS.How to reproduce
Create a vendor (or component, or release) and note its ID, e.g.
V1.Call the merge endpoint/method with the same ID as both target and source:
mergeVendors(mergeTargetId="V1", mergeSourceId="V1", mergeSelection, user)
Observe the response:
RequestStatus.SUCCESS.Attempt to fetch
V1afterward, it no longer exists.The same reproduction steps apply to
mergeComponentsandmergeReleases