Audit follow-up: Cached Contentlet instances mutated during relationship hydration

Parent epic: #36004

Finding

ContentUtils.addRelationships appears to mutate the Contentlet backing map in place via contentlet.getMap().putAll(...). The audit says cached contentlets are stored/returned by reference, so Story Block hydration can add request-scoped relationship/render keys to shared cached instances.

Report references: dotCMS/src/main/java/com/dotmarketing/portlets/contentlet/util/ContentUtils.java:844, ContentletCacheImpl around lines 75 and 91

Potential impact

Concurrent renders may pollute shared cached contentlets, causing nondeterministic rendered output and bloated cache entries under load.

Suggested validation

Render the same cached contentlet concurrently with different relationship/story-block hydration contexts and inspect cached map contents / output variation.

Possible fix

Operate on a defensive copy, for example new Contentlet(contentlet), before adding relationship/render attributes.

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start with ContentUtils.java around line 844 and inspect ContentletCacheImpl around lines 75 and 91 to verify whether cached Contentlet maps are shared by reference. Run the proposed concurrent hydration/render validation and inspect cached map contents and output variation; done means the mutation risk is confirmed or ruled out with coverage for the resulting behavior.