Two-level Malware Bug

lib/csn-runtime-extension.js

@@ -1,20 +1,27 @@
 const cds = require('@sap/cds')
-const { LinkedDefinitions } = require("@sap/cds/lib/core/linked-csn")
+
+function collectAttachments(ent, resultSet = [], path = []) {
+  if (!ent.compositions) return resultSet
+  for (const ele of Object.keys(ent.compositions)) {
+    const target = ent.compositions[ele]._target
+    const newPath = [...path, ele]
+    if (target?.["@_is_media_data"]) {
+      resultSet.push(newPath)
+    }
+    if (target && target !== ent) collectAttachments(target, resultSet, newPath)
+  }
+  return resultSet
+}
 
 Object.defineProperty(cds.builtin.classes.entity.prototype, '_attachments', {
   get() {
     const entity = this;
     return {
       get hasAttachmentsComposition() {
-        return entity.compositions && Object.keys(entity.compositions).some(ele => entity.compositions[ele]._target?.["@_is_media_data"] || entity.compositions[ele]._target?._attachments.hasAttachmentsComposition)
+        return entity.compositions && Object.keys(entity.compositions).some(ele => entity.compositions[ele]._target?.["@_is_media_data"] || entity.compositions[ele]._target?._attachments?.hasAttachmentsComposition)
       },
       get attachmentCompositions() {
-        const resultSet = new LinkedDefinitions()
-        if (!entity.compositions) return resultSet
-        for (const ele of Object.keys(entity.compositions).filter(ele => entity.compositions[ele]._target?.["@_is_media_data"] || entity.compositions[ele]._target?._attachments.hasAttachmentsComposition)) {
-          resultSet[ele] = entity.compositions[ele]
-        };
-        return resultSet;
+        return collectAttachments(entity)
       },
       get isAttachmentsEntity() {
         return !!entity?.["@_is_media_data"]

lib/generic-handlers.js

@@ -10,9 +10,21 @@ const objectStoreKind = cds.env.requires?.attachments?.objectStore?.kind
  * Prepares the attachment data before creation
  * @param {import('@sap/cds').Request} req - The request object
  */
-function onPrepareAttachment(req) {
+async function onPrepareAttachment(req) {
   if (!req.target?._attachments.isAttachmentsEntity) return;
 
+  const hasUpKey = Object.keys(req.data).some(key => key.startsWith("up__"))
+
+  if (!hasUpKey) {
+    const mySubject = { ...req.subject, ref: req.subject.ref.slice(0, -1) }
+    const parentKeys = Object.keys(cds.infer.target({SELECT: {from: mySubject}}).keys)
+    const parentRecord = await SELECT.one.from(mySubject).columns(parentKeys)
+
+    for (const key of parentKeys) {
+      req.data[`up__${key}`] = parentRecord[key]
+    }
+  }
+
   req.data.url = isMultitenacyEnabled && objectStoreKind === "shared"
     ? `${req.tenant}_${req.data.url}`
     : cds.utils.uuid()

lib/helper.js

@@ -384,6 +384,16 @@ function sizeInBytes(size, target) {
   return value * multipliers[unit]
 }
 
+function traverseEntity(root, path) {
+  let current = root
+  for (const part of path) {
+    if (!current.elements || !current.elements[part]) return undefined
+    current = current.elements[part]._target
+    if (!current) return undefined
+  }
+  return current
+}
+
 module.exports = {
   fetchToken,
   getObjectStoreCredentials,
@@ -392,5 +402,6 @@ module.exports = {
   fetchObjectStoreBinding,
   validateServiceManagerCredentials,
   checkMimeTypeMatch,
+  traverseEntity,
   MAX_FILE_SIZE
 }

lib/plugin.js

@@ -67,19 +67,6 @@ cds.ApplicationService.handle_attachments = cds.service.impl(async function () {
     return AttachmentsSrv.deleteAttachmentsWithKeys.bind(AttachmentsSrv)(res, req)
   })
 
-  // case: attachments uploaded in draft and draft is discarded
-  this.before(["CANCEL"], async function collectDiscardedAttachmentsForDraftEnabled(req) {
-    if (!req.target?.actives || !req.target?._attachments.hasAttachmentsComposition) return;
-    const AttachmentsSrv = await cds.connect.to("attachments")
-    return AttachmentsSrv.attachDraftDiscardDeletionData.bind(AttachmentsSrv)(req)
-  })
-  this.after(["CANCEL"], async function deleteCollectedDiscardedAttachmentsForDraftEnabled(res, req) {
-    // Check for actives to make sure it is the draft entity
-    if (!req.target?.actives || !req.target?._attachments.hasAttachmentsComposition) return;
-    const AttachmentsSrv = await cds.connect.to("attachments")
-    return AttachmentsSrv.deleteAttachmentsWithKeys.bind(AttachmentsSrv)(res, req)
-  })
-
 
   this.prepend(() =>
     this.on(

srv/basic.js

@@ -1,6 +1,6 @@
 const cds = require('@sap/cds')
 const LOG = cds.log('attachments')
-const { computeHash } = require('../lib/helper')
+const { computeHash, traverseEntity } = require('../lib/helper')
 
 class AttachmentsService extends cds.Service {
 
@@ -160,9 +160,14 @@ class AttachmentsService extends cds.Service {
           return
         }
         await Promise.all(
-          Object.keys(req.target._attachments.attachmentCompositions).map(attachmentsEle =>
-            this.draftSaveHandler(req.target.elements[attachmentsEle]._target)(res, req)
-          )
+          req.target._attachments.attachmentCompositions.map(attachmentsEle =>{
+            const target = traverseEntity(req.target, attachmentsEle)
+            if (!target) {
+              LOG.error(`Could not resolve target for attachment composition: ${attachmentsEle}`)
+              return
+            }
+            return this.draftSaveHandler(target)(res, req)
+          })
         )
       }.bind(this))
     }
@@ -195,8 +200,6 @@ class AttachmentsService extends cds.Service {
     return result?.status
   }
 
-
-
   /**
    * Registers attachment handlers for the given service and entity
    * @param {*} records - The records to process
@@ -213,13 +216,31 @@ class AttachmentsService extends cds.Service {
     })
   }
 
+  /**
+   * Traverses nested data by a given path array.
+   * @param {Object} root - The root object or array to traverse.
+   * @param {Array} path - The array of keys representing the path.
+   * @returns {*} - The value found at the path, or [] if not found.
+   */
+  traverseDataByPath(root, path) {
+    let current = root
+    for (let i = 0; i < path.length; i++) {
+      const part = path[i]
+      if (Array.isArray(current)) {
+        return current.flatMap(item => this.traverseDataByPath(item, path.slice(i)))
+      }
+      if (!current || !(part in current)) return []
+      current = current[part]
+    }
+    return current
+  }
+
   /**
    * Registers attachment handlers for the given service and entity
    * @param {import('@sap/cds').Request} req - The request object
    */
   async attachDeletionData(req) {
-    const attachmentCompositions = Object.keys(req?.target?.associations)
-      .filter(assoc => req?.target?.associations[assoc]._target['@_is_media_data'])
+    const attachmentCompositions = req?.target?._attachments.attachmentCompositions
     if (attachmentCompositions.length > 0) {
       const diffData = await req.diff()
       if (!diffData || Object.keys(diffData).length === 0) {
@@ -228,17 +249,15 @@ class AttachmentsService extends cds.Service {
       const queries = []
       const queryTargets = []
       for (const attachmentsComp of attachmentCompositions) {
-        let deletedAttachments = []
-        diffData[attachmentsComp]?.forEach(object => {
-          if (object._op === "delete") {
-            deletedAttachments.push(object.ID)
-          }
-        })
+        const leaf = this.traverseDataByPath(diffData, attachmentsComp)
+        const deletedAttachments = Array.isArray(leaf) ? leaf.filter(obj => obj._op === "delete").map(obj => obj.ID) : []
+
+        const entityTarget = traverseEntity(req.target, attachmentsComp)
         if (deletedAttachments.length) {
           queries.push(
-            SELECT.from(req.target.associations[attachmentsComp]._target).columns("url").where({ ID: { in: [...deletedAttachments] } })
+            SELECT.from(entityTarget).columns("url").where({ ID: { in: [...deletedAttachments] } })
           )
-          queryTargets.push(req.target.associations[attachmentsComp]._target.name)
+          queryTargets.push(entityTarget.name)
         }
       }
       if (queries.length > 0) {
@@ -296,39 +315,6 @@ class AttachmentsService extends cds.Service {
     }
   }
 
-  /**
-   * Add draft discard deletion data to the request
-   * @param {import('@sap/cds').Request} req - The request object
-   */
-  async attachDraftDiscardDeletionData(req) {
-    const parentEntity = req.target.name.split('.').slice(0, -1).join('.')
-    const draftEntity = cds.model.definitions[`${parentEntity}.attachments.drafts`]
-    const activeEntity = cds.model.definitions[`${parentEntity}.attachments`]
-    if (!draftEntity || !activeEntity) return
-
-    const whereXpr = []
-    for (const foreignKey of activeEntity.keys['up_']._foreignKeys) {
-      if (whereXpr.length) {
-        whereXpr.push('and')
-      }
-      whereXpr.push(
-        { ref: [foreignKey.parentElement.name] },
-        '=',
-        { val: req.data[foreignKey.childElement.name] }
-      )
-    }
-
-    const attachmentsToDelete = await this.getAttachmentsToDelete({
-      draftEntity,
-      activeEntity,
-      whereXpr
-    })
-
-    if (attachmentsToDelete.length > 0) {
-      req.attachmentsToDelete = attachmentsToDelete
-    }
-  }
-
   /**
    * Deletes a file from the database. Does not delete metadata
    * @param {string} url - The url of the file to delete

tests/incidents-app/app/incidents/annotations.cds

@@ -172,3 +172,48 @@ annotate service.Incidents.conversation with @(
             Label : '{i18n>Message}',
         },]
 );
+
+annotate service.Test with @(
+    UI.SemanticKey : [name],
+    UI.LineItem : [
+        {
+            Value : name,
+            Label : 'Name',
+        },
+    ]
+);
+
+annotate service.TestDetails with @(
+    UI.SemanticKey : [description],
+    UI.LineItem : [
+        {
+            Value : description,
+            Label : 'Description',
+        },
+    ]
+);
+
+annotate service.Test with @(
+  UI.Facets : [
+    {
+      $Type : 'UI.ReferenceFacet',
+      Label : 'Details',
+      Target : 'details/@UI.LineItem'
+    },
+    {
+      $Type : 'UI.ReferenceFacet',
+      Label : 'Attachments',
+      Target : 'attachments/@UI.LineItem'
+    }
+  ]
+);
+
+annotate service.TestDetails with @(
+  UI.Facets : [
+    {
+      $Type : 'UI.ReferenceFacet',
+      Label : 'Attachments',
+      Target : 'attachments/@UI.LineItem'
+    }
+  ]
+);

tests/incidents-app/db/attachments.cds

@@ -33,3 +33,19 @@ extend my.Customers with {
 extend my.SampleRootWithComposedEntity with {
   attachments : Composition of many Attachments;
 }
+
+extend my.Test with {
+  attachments: Composition of many Attachments;
+}
+
+extend my.TestDetails with {
+  attachments: Composition of many Attachments;
+}
+
+extend my.NonDraftTest with {
+  attachments: Composition of many Attachments;
+}
+
+extend my.SingleTestDetails with {
+  attachments : Composition of many Attachments;
+}

tests/incidents-app/db/data/sap.capire.incidents-NonDraftTest.csv

@@ -0,0 +1,3 @@
+ID,name,singledetails_ID
+33333333-3333-3333-3333-333333333333,Test Parent 1,877fc800-337e-495e-a497-c1a95fbfe6a3
+44444444-4444-4444-4444-444444444444,Test Parent 2,877fc800-337e-495e-a497-c1a95fbfe6a3

tests/incidents-app/db/data/sap.capire.incidents-SingleTestDetails.csv

@@ -0,0 +1,8 @@
+ID,abc
+877fc800-337e-495e-a497-c1a95fbfe6a3,My fancy text
+e1ab7f04-40d3-434a-a638-c14d40f2b52c,My fancy text
+d899ed80-7418-4d58-9772-b23db76fee8f,My fancy text
+f774c1a0-f9a6-45d5-be48-99cf8df388a2,My fancy text
+c5f57897-0c64-41f4-a303-dfad518a1512,My fancy text
+0fb9eda6-2989-4e14-be17-bf0da71b5f55,My fancy text
+27b34131-ffaa-4086-8e95-f1ed92f37768,My fancy text

tests/incidents-app/db/data/sap.capire.incidents-Test.csv

@@ -0,0 +1,3 @@
+ID,name
+11111111-1111-1111-1111-111111111111,Test Parent 1
+22222222-2222-2222-2222-222222222222,Test Parent 2

tests/incidents-app/db/data/sap.capire.incidents-TestDetails.csv

@@ -0,0 +1,4 @@
+ID;test_ID;description
+aaaaaaa1-aaaa-aaaa-aaaa-aaaaaaaaaaa1;11111111-1111-1111-1111-111111111111;Detail 1 for Test 1
+aaaaaaa2-aaaa-aaaa-aaaa-aaaaaaaaaaa2;11111111-1111-1111-1111-111111111111;Detail 2 for Test 1
+bbbbbbb1-bbbb-bbbb-bbbb-bbbbbbbbbbb1;22222222-2222-2222-2222-222222222222;Detail 1 for Test 2

tests/incidents-app/db/schema.cds

@@ -76,3 +76,24 @@ entity SampleRootWithComposedEntity {
   key sampleID : String;
   key gjahr    : Integer;
 }
+
+entity Test : cuid, managed {
+  key ID      : String;
+  name        : String;
+  details     : Composition of many TestDetails on details.test = $self;
+}
+
+entity TestDetails : cuid, managed {
+  test        : Association to Test;
+  description : String;
+}
+
+entity NonDraftTest : cuid, managed {
+  key ID      : String;
+  name        : String;
+  singledetails : Composition of one SingleTestDetails;
+}
+
+entity SingleTestDetails : cuid {
+  abc: String;
+}

tests/incidents-app/srv/services.cds

@@ -11,6 +11,15 @@ service ProcessorService {
 
   @odata.draft.enabled
   entity SampleRootWithComposedEntity as projection on my.SampleRootWithComposedEntity;
+
+  @odata.draft.enabled
+  entity Test as projection on my.Test;
+
+  entity TestDetails as projection on my.TestDetails;
+
+  entity NonDraftTest as projection on my.NonDraftTest;
+
+  entity SingleTestDetails as projection on my.SingleTestDetails;
 }
 
 /**