apache / apache/couchdb

Validate Document Update oldDoc in ddoc is null after doc PUT for n=1 server

Open
#1,712 12 comments 0 reactions 0 assignees View on GitHub
Dominant language
Erlang
Stars
7k
Forks
1.1k
Avg merge
1d 16h
Merged PRs (30d)
9

Description

## Context
We have a PouchDB client that keeps in sync the client DB with a CouchDB server using push / pull replications.
Also on the server side to ensure that the createdBy field cannot be maliciously falsified we are using a validate_doc_update design doc.

## BUG
For more of our most frequently updated (EXISTING) documents from time to time it happens that the oldDoc is null in the server execution of the validate_doc_update, and hence identified as a malicious creation (other createdBy user than context user), hence the updated is rejected, but in fact this is a document updated, which is perfectly ok.

## Steps to Reproduce (for bugs)
As for the steps to reproduce it we didn't manage to pinpoint the scenario but we have enabled logging and trying to watch out for these, and we have attached the server and client doc versions, design doc, the previous _revs_diff and _bulk_docs request that returns the error.
[doc_server_and_client_versions.txt](https://github.com/apache/couchdb/files/2548112/doc_server_and_client_versions.txt)
[bulk_docs_request_response.txt](https://github.com/apache/couchdb/files/2548068/bulk_docs_request_response.txt)
[validate_doc_update.txt](https://github.com/apache/couchdb/files/2548069/validate_doc_update.txt)
[revs_diff_request_response.txt](https://github.com/apache/couchdb/files/2548070/revs_diff_request_response.txt)

This has a deep impact in our app, because this document updates from the specific client don't get replicated anymore.
Will try to preserve the context, so that we can provide extra info if needed

## Your Environment

* Version used: 2.2.0
* Browser Name and version: Chrome
* Operating System and version (desktop or mobile): Windows 10

Contributor guide

Open the contributing guide

Research direction

Start with the attached server and client document versions, the validate_doc_update design document, and the _revs_diff and _bulk_docs request/response files. Compare the revision data with the validation inputs and determine why oldDoc is null for an existing document; done means reproducing the rejected update and establishing a fix or confirmed explanation.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang, javascript
Domain
databases, distributed-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.