cassieq
cassieq copied to clipboard
Non-atomic update in addNewKey
In the file:
cassieq/core/src/main/java/io/paradoxical/cassieq/admin/resources/api/v1/AccountResource.java
The addNewKey operation is not safe for concurrent addition of keys - one will overwrite the other. For example, two clients inserting a key (one inserts, 581, indented one inserts 536).
SELECT keys FROM account WHERE account = ‘webapp’
SELECT keys FROM account WHERE account = ‘webapp’
UPDATE account SET keys = {102, 581} WHERE account = ‘webapp’
UPDATE account SET keys = {102, 536} WHERE account = ‘webapp’
It should instead use the set addition operator:
UPDATE account SET keys = keys + {581} WHERE account = ‘webapp’
https://docs.datastax.com/en/cql/3.1/cql/cql_using/use_set_t.html