apache / apache/arrow-java

[FlightSQL] Statement.execute(String) can leak server prepared-statement handles when reused

未关闭
#1,129 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
Type: bug
主要语言
Java
星标
94
派生
152
平均合并
3 天 16 小时
30 天内合并 PR
11

描述

### Describe the bug, including details regarding any error messages, version, and platform.

When reusing the same JDBC Statement and calling execute(String) multiple times, the Flight SQL JDBC path creates a new prepared statement on each call, but previous prepared handles are not closed before being replaced in client tracking state.

This means only the latest handle is guaranteed to be closed when the statement is closed. On stateful Flight SQL servers, this can leak server-side resources associated with older handles.

Repro
```
try (Connection connection = DriverManager.getConnection(jdbcUrl, properties);
Statement statement = connection.createStatement()) {

for (int i = 1; i <= n; i++) {
String sql = "SELECT " + i;
boolean isResultSet = statement.execute(sql);
if (isResultSet) {
try (ResultSet rs = statement.getResultSet()) {
while (rs.next()) { /* consume */ }
}
}
}
}
```

Raised in https://github.com/apache/arrow-java/pull/1090#discussion_r3132344585

贡献指南

打开贡献指南

调研方向

从 Flight SQL 的 JDBC 实现中的 Statement.execute(String) 开始,跟踪 prepared-statement handles 是如何被替换和关闭的;该 issue 没有指明文件或测试。针对有状态的 Flight SQL 服务器重现该循环,然后验证每个先前的 handle 都会在下一个 handle 被跟踪之前释放,并且 Statement.close 仍会清理最终的 handle。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
databases
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
55/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。