Contrib.social

file_get_file_references() static cache causes stale data after entity save

Open on Drupal.org →
Created on 8 August 2025, 7 days ago

Problem/Motivation

The file_get_file_references() function uses static caching that is not properly invalidated when entities are persisted, leading to data integrity and access control misconfiguration issues. This occurs when the function is called before entity persistence (returning empty results) and the cached result is reused for subsequent calls in the same request, even after the entity has been saved.

The issue manifests when:

  • file_get_file_references() is first called during form processing via ManagedFile::valueCallback()
  • At this point, the parent entity hasn't been persisted yet, so the function returns no references
  • This empty result is statically cached
  • Later calls to the function (e.g., in hook_entity_insert() implementations) receive the stale cached data instead of current references

Steps to reproduce

  1. Create a content type with a file field
  2. Add a node with a file attachment through the UI
  3. Implement a hook_entity_insert() that calls file_get_file_references() for the attached file
  4. Observe that the function returns empty results despite the file now being referenced by the saved entity
  5. Verify the call stack shows the sequence: ManagedFile::valueCallback() → FileAccessControlHandler->getFileReferences() → file_get_file_references()

Proposed resolution

Implement static cache invalidation in file_get_file_references() when entities containing file fields are inserted. This ensures that subsequent calls to the function within the same request return up-to-date reference information.

Remaining tasks

Verify if parent entity update/delete could be also impacted by this cache invalidation issue anyhow; if yes, address that issue too.

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component

file.module

Created by

🇭🇺Hungary mxr576 Hungary

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @mxr576
  • Comment 7 days ago →
    🇭🇺Hungary mxr576 Hungary
  • First commit to issue fork.
  • Merge request !12966Draft: #3540424 "Filegetfilereferences static cache" → (Open) created by ericgsmith
  • Pipeline finished with Failed
    4 days ago
    Total: 187s
    #570476
  • Comment 4 days ago →
    🇳🇿New Zealand ericgsmith

    I had previously mentioned this in https://www.drupal.org/project/drupal/issues/3035352#comment-15214406 📌 Deprecate file_get_file_references(). Move the logic to file.usage service Needs work but I should have opened a new issue for this.

    Copying the test and patch from that comment - it was very work in progress just copying over so its not lost - I suspect it still has a few issues but I've been using it for a while.

    I recall I may have discussed this offline with somebody at some point (sorry, memory is terrible) and the idea was #3035352 would be a good place to solve this as it was being refactored into a service there - but given that has been postponed for a long time now hopefully we can git this fixed.

  • Pipeline finished with Failed
    4 days ago
    Total: 165s
    #570484
  • Pipeline finished with Success
    3 days ago
    Total: 1069s
    #570489
contrib.social Blog FAQ Discussions
Production build 0.71.5 2024