googleapis / googleapis/google-http-java-client

Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeException

オープン 初心者向け
#2,177 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Java
スター
1.4k
フォーク
473
PR マージ指標
30日以内にマージされた PR はありません

説明

Environment details:
1. Core — HttpRequest.execute() in google-http-client
2. OS type and version: Any (not OS-specific)
3. Java version: Any (reproduces on Java 8+)
4. google-http-client version(s): reproducible on current main

Steps to reproduce:
1. Implement a LowLevelHttpResponse whose getContentEncoding() throws a RuntimeException.
2. Execute an HttpRequest against that transport.
3. Catch the RuntimeException from execute().
4. Observe disconnect() was never called on the low-level response.

Code example:
```java
MockLowLevelHttpResponse failingResponse = new MockLowLevelHttpResponse() {
@Override
public String getContentEncoding() {
throw new RuntimeException("simulated failure");
}
};

HttpTransport transport = new MockHttpTransport() {
@Override
public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
return new MockLowLevelHttpRequest().setResponse(failingResponse);
}
};

HttpRequest req = transport.createRequestFactory()
.buildGetRequest(new GenericUrl("http://example.com"));

try {
req.execute();
} catch (RuntimeException e) {
// failingResponse.isDisconnected() == false <-- BUG: socket leaked
}
```

Stack trace:
None — silent resource leak, not a crash. The RuntimeException propagates as expected; the
bug is that execute()'s finally block never calls LowLevelHttpResponse#disconnect() here.

External references:
- HttpRequest#execute(): google-http-client/src/main/java/com/google/api/client/http/HttpRequest.java

Any additional information:
Under sustained error conditions, leaked connections accumulate until the pool is exhausted,
risking DoS/thread starvation. Pre-existing bug, unrelated to security hardening — found
opportunistically during a security audit of this file.

Proposed fix — in execute()'s finally block, add a guarded disconnect():

```java
} finally {
if (!responseConstructed && lowLevelHttpResponse != null) {
try {
InputStream c = lowLevelHttpResponse.getContent();
if (c != null) c.close();
} catch (IOException ignored) {}
try {
lowLevelHttpResponse.disconnect();
} catch (IOException ignored) {}
}
}
```

Regression test testExecute_disconnectOnResponseConstructionFailure included in the
accompanying PR.

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Start in google-http-client/src/main/java/com/google/api/client/http/HttpRequest.java, focusing on HttpRequest.execute() and its finally block. Reproduce the failure with a LowLevelHttpResponse whose getContentEncoding() throws, then run testExecute_disconnectOnResponseConstructionFailure. Done means the low-level response is disconnected when response construction fails and the regression test passes.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
java
領域
networking
issue の種類
バグ
難易度
2/5
見積もり時間
1〜3時間
活発さ
静か
明瞭さ
明確に書かれている
初心者へのやさしさ
84/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。