Merge branch 'AC-10890' into cia-2.4.8-beta2-develop-bugfix-10072024

Author: pawan-adobe-security

app/code/Magento/Quote/Model/BillingAddressManagement.php

@@ -7,17 +7,27 @@
 
 namespace Magento\Quote\Model;
 
+use Magento\Customer\Api\AddressRepositoryInterface;
 use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Exception\InputException;
 use Magento\Quote\Api\BillingAddressManagementInterface;
+use Magento\Quote\Api\CartRepositoryInterface;
 use Magento\Quote\Api\Data\AddressInterface;
 use Psr\Log\LoggerInterface as Logger;
 
 /**
  * Quote billing address write service object.
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
 class BillingAddressManagement implements BillingAddressManagementInterface
 {
+    /**
+     * Billing address lock const
+     *
+     * @var string
+     */
+    private const CART_BILLING_ADDRESS_LOCK = 'cart_billing_address_lock_';
+
     /**
      * Validator.
      *
@@ -35,12 +45,12 @@ class BillingAddressManagement implements BillingAddressManagementInterface
     /**
      * Quote repository object.
      *
-     * @var \Magento\Quote\Api\CartRepositoryInterface
+     * @var CartRepositoryInterface
      */
     protected $quoteRepository;
 
     /**
-     * @var \Magento\Customer\Api\AddressRepositoryInterface
+     * @var AddressRepositoryInterface
      */
     protected $addressRepository;
 
@@ -49,24 +59,33 @@ class BillingAddressManagement implements BillingAddressManagementInterface
      */
     private $shippingAddressAssignment;
 
+    /**
+     * @var CartAddressMutexInterface
+     */
+    private $cartAddressMutex;
+
     /**
      * Constructs a quote billing address service object.
      *
-     * @param \Magento\Quote\Api\CartRepositoryInterface $quoteRepository Quote repository.
+     * @param CartRepositoryInterface $quoteRepository Quote repository.
      * @param QuoteAddressValidator $addressValidator Address validator.
      * @param Logger $logger Logger.
-     * @param \Magento\Customer\Api\AddressRepositoryInterface $addressRepository
+     * @param AddressRepositoryInterface $addressRepository
+     * @param CartAddressMutexInterface|null $cartAddressMutex
      */
     public function __construct(
-        \Magento\Quote\Api\CartRepositoryInterface $quoteRepository,
+        CartRepositoryInterface $quoteRepository,
         QuoteAddressValidator $addressValidator,
         Logger $logger,
-        \Magento\Customer\Api\AddressRepositoryInterface $addressRepository
+        AddressRepositoryInterface $addressRepository,
+        ?CartAddressMutexInterface $cartAddressMutex = null
     ) {
         $this->addressValidator = $addressValidator;
         $this->logger = $logger;
         $this->quoteRepository = $quoteRepository;
         $this->addressRepository = $addressRepository;
+        $this->cartAddressMutex = $cartAddressMutex ??
+            ObjectManager::getInstance()->get(CartAddressMutex::class);
     }
 
     /**
@@ -75,8 +94,29 @@ public function __construct(
      */
     public function assign($cartId, AddressInterface $address, $useForShipping = false)
     {
-        /** @var \Magento\Quote\Model\Quote $quote */
+        /** @var Quote $quote */
         $quote = $this->quoteRepository->getActive($cartId);
+        $billingAddressId = (int) $quote->getBillingAddress()->getId();
+
+        return $this->cartAddressMutex->execute(
+            self::CART_BILLING_ADDRESS_LOCK.$billingAddressId,
+            $this->assignBillingAddress(...),
+            $billingAddressId,
+            [$address, $quote, $useForShipping]
+        );
+    }
+
+    /**
+     * Assign billing address to cart
+     *
+     * @param AddressInterface $address
+     * @param Quote $quote
+     * @param bool $useForShipping
+     * @return mixed
+     * @throws InputException
+     */
+    private function assignBillingAddress(AddressInterface $address, Quote $quote, bool $useForShipping = false)
+    {
         $address->setCustomerId($quote->getCustomerId());
         $quote->removeAddress($quote->getBillingAddress()->getId());
         $quote->setBillingAddress($address);
@@ -85,9 +125,10 @@ public function assign($cartId, AddressInterface $address, $useForShipping = fal
             $quote->setDataChanges(true);
             $this->quoteRepository->save($quote);
         } catch (\Exception $e) {
-            $this->logger->critical($e);
+            $this->logger->critical($e->getMessage());
             throw new InputException(__('The address failed to save. Verify the address and try again.'));
         }
+
         return $quote->getBillingAddress()->getId();
     }
 

app/code/Magento/Quote/Model/CartAddressMutex.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ *
+ * Copyright 2024 Adobe
+ * All Rights Reserved.
+ *
+ * NOTICE: All information contained herein is, and remains
+ * the property of Adobe and its suppliers, if any. The intellectual
+ * and technical concepts contained herein are proprietary to Adobe
+ * and its suppliers and are protected by all applicable intellectual
+ * property laws, including trade secret and copyright laws.
+ * Dissemination of this information or reproduction of this material
+ * is strictly forbidden unless prior written permission is obtained
+ * from Adobe.
+ * ************************************************************************
+ */
+declare(strict_types=1);
+
+namespace Magento\Quote\Model;
+
+use Magento\Framework\Lock\LockManagerInterface;
+
+/**
+ * @inheritDoc
+ */
+class CartAddressMutex implements CartAddressMutexInterface
+{
+    /**
+     * @var LockManagerInterface
+     */
+    private $lockManager;
+
+    /**
+     * @param LockManagerInterface $lockManager
+     */
+    public function __construct(
+        LockManagerInterface $lockManager,
+    ) {
+        $this->lockManager = $lockManager;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(string $lockName, callable $callable, int $result, array $args = [])
+    {
+        if (!$this->lockManager->lock($lockName, 0)) {
+            return $result;
+        }
+        try {
+            $result = $callable(...$args);
+        } finally {
+            $this->lockManager->unlock($lockName);
+        }
+
+        return $result;
+    }
+}

app/code/Magento/Quote/Model/CartAddressMutexInterface.php

@@ -0,0 +1,36 @@
+<?php
+/************************************************************************
+ *
+ * Copyright 2024 Adobe
+ * All Rights Reserved.
+ *
+ * NOTICE: All information contained herein is, and remains
+ * the property of Adobe and its suppliers, if any. The intellectual
+ * and technical concepts contained herein are proprietary to Adobe
+ * and its suppliers and are protected by all applicable intellectual
+ * property laws, including trade secret and copyright laws.
+ * Dissemination of this information or reproduction of this material
+ * is strictly forbidden unless prior written permission is obtained
+ * from Adobe.
+ * ************************************************************************
+ */
+declare(strict_types=1);
+
+namespace Magento\Quote\Model;
+
+/**
+ * Intended to prevent race conditions during quote address processing by concurrent requests.
+ */
+interface CartAddressMutexInterface
+{
+    /**
+     * Acquires a lock for quote address, executes callable and releases the lock after.
+     *
+     * @param string $lockName
+     * @param callable $callable
+     * @param int $result
+     * @param array $args
+     * @return mixed
+     */
+    public function execute(string $lockName, callable $callable, int $result, array $args = []);
+}