[jira] [Commented] (OAK-753) TreeImpl exposes hidden child trees

["Jukka Zitting (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OAK-753?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13623481#comment-13623481 ] 

Jukka Zitting commented on OAK-753:
-----------------------------------

I'd push the visibility check down to SecureNodeState as outlined in OAK-709. The :hidden mechanism is related to access control, since the rationale for such hidden content is to avoid the need for complex access control handling for things like query indexes and other internal aggregate data that might otherwise expose read-protected content.
                
> TreeImpl exposes hidden child trees
> -----------------------------------
>
>                 Key: OAK-753
>                 URL: https://issues.apache.org/jira/browse/OAK-753
>             Project: Jackrabbit Oak
>          Issue Type: Task
>          Components: core
>            Reporter: angela
>
> while we are having an extra test to prevent hidden property states
> from being exposed on the oak-api, we forgot to add the same check for
> child trees.
> while adding the test is pretty straight forward it would have an impact
> not only on #getChild(String) but also on
> - #getChildren
> - #getChildrenCount
> - #getOrderedChildNames
> - ...
> the simple check without addressing the other methods (already taking OAK-709 into account):
> {code}
> private boolean canRead(TreeImpl tree) {
>         return tree.getNodeState().exists() && !NodeStateUtils.isHidden(tree.getName());
>     }
> {code}
> adding this test will cause the following tests to fail
> - o.a.j.test.nodetype.NodeTypeTest#testGetPrimaryItemName which traverses the
>   repository instead of using a configured node type to setup an appropriate test and fails with the short-cut for childcnt being 1 in NodeDelegate
> - TypeEditorTest#ignoreHidden which tries to create hidden nodes using
>   the oak api (see also OAK-695)

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira