eclipse-ee4j / eclipse-ee4j/jersey
Memory leak in jersey-media-jaxb and core-common
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
We have identified a memory leak in `ContextResolverFactory` in package `core-common`. What happens is that `resolve` can be called with arbitrary media types and thus the cache will be hit with putIfAbsent for every request.
To reproduce we need to use `jersey-media-jaxb` with a custom ContextResolver for JAXBContext for custom MediaType. eg `application/vnd.mydomain+xml`. That will cause the request to hit `AbstractJaxbProvider:178` which in turn will call resolve in `ContextResolverFactory:194`. This will eventually hit `crMapCache.putIfAbsent(m, cr);` on line 228.
If the media type sent from internet is `application/vnd.mydomain+xml`, this will only put one object into the cache. But if someone has a bug where they use the header `content-type: application/vnd.mydomain+xml;boundary=----321231` where the number is a very random number, the `crMapCache` will cache the same ContextResolver instance for every request.
The solution for us is to intercept the request and change the header so that there are no attributes on the header. Of course this is fine when there is a multipart requests.
Contributor guide
Assessment
This issue has not been assessed yet.