Don't miss out Virtual Happy Hour this Friday (April 26).

Try our conversational search powered by Generative AI!

Unsafe use of shared DTOs

Found in

EPiServer.Commerce 11.0.0

Fixed in

EPiServer.Commerce 11.2.4

(Or a related package)

Created

Aug 29, 2017

Updated

Sep 22, 2017

Area

Core

State

Closed, Fixed and tested


Description

When a DTO is loaded through cache, it should never be used directly in data manipulations because other consumers may be holding reference to the same object. There are a number of places in the commerce codebase where this is not respected.

Examples:
CatalogEntryManager.DeleteCatalogEntry, DeleteCatalogEntries
CatalogNodeManager.DeleteCatalogNode

In this case, the DTOs are used to delete rows, causing deleted row inaccessible operations in other consumers trying to read the data after it has been marked for removal. The risk of this causing problems is small because reference to DTOs is generally held for a very short time, and the cache is purged after the delete operation completes.