Ensure modifying project endpoints are transactional

The `/api/v1/project` endpoints used to modify `Project` resources have historically not been transactional, potentially causing inconsistencies or too frequent commits (since every object modification implicitly creates a transaction behind the scenes). Wrap code in `runInTransaction` or `callInTransaction` to ensure the desired transactional behavior. Signed-off-by: nscuro <[email protected]>
DependencyTrack · Sep 24, 2024 · c558dfa · c558dfa
1 parent c87faef
commit c558dfa
Show file tree

Hide file tree

Showing 2 changed files with 184 additions and 123 deletions.
diff --git a/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java b/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java
@@ -53,7 +53,6 @@
 
 import javax.jdo.PersistenceManager;
 import javax.jdo.Query;
-import javax.jdo.Transaction;
 import javax.jdo.metadata.MemberMetadata;
 import javax.jdo.metadata.TypeMetadata;
 import java.security.Principal;
@@ -656,20 +655,14 @@ public Project clone(UUID from, String newVersion, boolean includeTags, boolean
     }
 
     /**
-     * Deletes a Project and all objects dependant on the project.
+     * Deletes a Project and all objects dependent on the project.
      *
      * @param project     the Project to delete
      * @param commitIndex specifies if the search index should be committed (an expensive operation)
      */
     @Override
     public void recursivelyDelete(final Project project, final boolean commitIndex) {
-        final Transaction trx = pm.currentTransaction();
-        final boolean isJoiningExistingTrx = trx.isActive();
-        try {
-            if (!isJoiningExistingTrx) {
-                trx.begin();
-            }
-
+        runInTransaction(() -> {
             for (final Project child : project.getChildren()) {
                 // Note: This could be refactored such that each project is deleted
                 //   in its own transaction. That would break semantics when it comes
@@ -706,16 +699,7 @@ public void recursivelyDelete(final Project project, final boolean commitIndex)
             } finally {
                 projectQuery.closeAll();
             }
-
-            if (!isJoiningExistingTrx) {
-                trx.commit();
-            }
-
-        } finally {
-            if (!isJoiningExistingTrx && trx.isActive()) {
-                trx.rollback();
-            }
-        }
+        });
     }
 
     /**