AttachmentService update can fail after concurrent attachment upload

XMLWordPrintable

    • Severity 3 - Minor
    • CtB - Improve Existing

      Issue Summary

      `AttachmentService.updateData(...)` can fail with `EntityNotFoundException` after the concurrent attachment upload path changes attachment or page `ContentProperty` records in a separate transaction. The caller's transaction still holds an older Hibernate entity graph. When Confluence then refreshes that graph, Hibernate can cascade to a property row that the concurrent transaction deleted or replaced, causing the exception.
       
      This affects integrations that call `AttachmentService.updateData(...)` inside their own transaction.

      Steps to Reproduce

      1. Create a page and attachment.
      2. Add an existing `attachmentChanged-*` property to the containing page (through a plugin, or a direct database insert into CONTENTPROPERTIES).
      3. In a caller-managed transaction, load the attachment container's property collection so it retains that existing property.
      4. Call `AttachmentService.updateData(...)` once for the attachment.
      5. The concurrent upload transaction removes/replaces the property.
      6. The caller-side `refresh(container)` cascades into the deleted property and throws `EntityNotFoundException`.

      Expected Results

      The attachment data is updated with the data provided to `updateData`

      Actual Results

      The `EntityNotFoundException` is raised and the transaction rolls back.

      The below exception is thrown in the logs:

      jakarta.persistence.EntityNotFoundException: No row with the given identifier exists: [com.atlassian.confluence.content.ContentProperty#564330559]
      ...
          at jdk.proxy4/jdk.proxy4.$Proxy266.refresh(Unknown Source)
          at com.atlassian.confluence.api.impl.service.content.AttachmentServiceImpl.updateAttachmentData(AttachmentServiceImpl.java:485)
          at com.atlassian.confluence.api.impl.service.content.AttachmentServiceImpl.updateData(AttachmentServiceImpl.java:316) 

      Workaround

      The following sysprop can be enabled on instances (>=9.2.22 or >=10.2.14) to avoid uploading attachments in a separate transaction when calling updateData (preventing the calling transaction from going out of sync):

      -Dconfluence.attachment.upload.concurrency.guard.disabled=true

              Assignee:
              Tom Smallridge
              Reporter:
              Tom Smallridge
              Votes:
              1 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: