JPA Manytomany Cascade Remove

ID

java.jpa_manytomany_cascade_remove

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

hibernate, jpa, orm

Description

Reports @ManyToMany associations with CascadeType.REMOVE or CascadeType.ALL. Cascading deletes on many-to-many relationships propagate beyond the join table and may inadvertently delete rows that are still referenced by other entities.

Rationale

Reliability — Deleting one side of a many-to-many relationship cascades the removal to the other side, potentially deleting shared entities that are still in use.

Remediation

Non-compliant code

@ManyToMany(cascade = CascadeType.ALL)
private Set<Tag> tags;

Compliant code

@ManyToMany(cascade = {CascadeType.PERSIST, CascadeType.MERGE})
private Set<Tag> tags;

References