[Security]

[CJBshuosi]

The logic for updating _doi_index, _arxiv_index, _s2_index, and _openalex_index within _merge_paper relies on self._find_index(existing). This _find_index method computes the title hash and looks it up in _title_hash_index. This approach is problematic because if the existing paper was initially indexed by an identifier (e.g., DOI) and not its title hash, _find_index might return -1, leading to incorrect index updates for the canonical identifiers. The indexes should be updated directly using the idx of the existing paper, which is already known from _find_duplicate.

        # Fill in missing identifiers
        if not existing.doi and new.doi:
            existing.doi = new.doi
            self._doi_index[new.doi.lower().strip()] = self._find_index(existing) # This line is problematic
        if not existing.arxiv_id and new.arxiv_id:
            existing.arxiv_id = new.arxiv_id
            self._arxiv_index[new.arxiv_id.lower().strip()] = self._find_index(existing) # This line is problematic
        if not existing.semantic_scholar_id and new.semantic_scholar_id:
            existing.semantic_scholar_id = new.semantic_scholar_id
            self._s2_index[new.semantic_scholar_id.lower().strip()] = self._find_index(existing) # This line is problematic
        if not existing.openalex_id and new.openalex_id:
            existing.openalex_id = new.openalex_id
            self._openalex_index[new.openalex_id.lower().strip()] = self._find_index(existing) # This line is problematic

Originally posted by @gemini-code-assist[bot] in #27 (comment)