googleapis / googleapis/google-http-java-client

Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeException

Đang mở Phù hợp với người mới
#2,177 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Java
Star
1.4k
Fork
473
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

Environment details:
1. Core — HttpRequest.execute() in google-http-client
2. OS type and version: Any (not OS-specific)
3. Java version: Any (reproduces on Java 8+)
4. google-http-client version(s): reproducible on current main

Steps to reproduce:
1. Implement a LowLevelHttpResponse whose getContentEncoding() throws a RuntimeException.
2. Execute an HttpRequest against that transport.
3. Catch the RuntimeException from execute().
4. Observe disconnect() was never called on the low-level response.

Code example:
```java
MockLowLevelHttpResponse failingResponse = new MockLowLevelHttpResponse() {
@Override
public String getContentEncoding() {
throw new RuntimeException("simulated failure");
}
};

HttpTransport transport = new MockHttpTransport() {
@Override
public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
return new MockLowLevelHttpRequest().setResponse(failingResponse);
}
};

HttpRequest req = transport.createRequestFactory()
.buildGetRequest(new GenericUrl("http://example.com"));

try {
req.execute();
} catch (RuntimeException e) {
// failingResponse.isDisconnected() == false <-- BUG: socket leaked
}
```

Stack trace:
None — silent resource leak, not a crash. The RuntimeException propagates as expected; the
bug is that execute()'s finally block never calls LowLevelHttpResponse#disconnect() here.

External references:
- HttpRequest#execute(): google-http-client/src/main/java/com/google/api/client/http/HttpRequest.java

Any additional information:
Under sustained error conditions, leaked connections accumulate until the pool is exhausted,
risking DoS/thread starvation. Pre-existing bug, unrelated to security hardening — found
opportunistically during a security audit of this file.

Proposed fix — in execute()'s finally block, add a guarded disconnect():

```java
} finally {
if (!responseConstructed && lowLevelHttpResponse != null) {
try {
InputStream c = lowLevelHttpResponse.getContent();
if (c != null) c.close();
} catch (IOException ignored) {}
try {
lowLevelHttpResponse.disconnect();
} catch (IOException ignored) {}
}
}
```

Regression test testExecute_disconnectOnResponseConstructionFailure included in the
accompanying PR.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

Start in google-http-client/src/main/java/com/google/api/client/http/HttpRequest.java, focusing on HttpRequest.execute() and its finally block. Reproduce the failure with a LowLevelHttpResponse whose getContentEncoding() throws, then run testExecute_disconnectOnResponseConstructionFailure. Done means the low-level response is disconnected when response construction fails and the regression test passes.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
java
Lĩnh vực
networking
Loại issue
Lỗi
Độ khó
2/5
Thời gian dự kiến
1-3 giờ
Mức độ hoạt động
Ít trao đổi
Độ rõ ràng
Đặc tả rõ ràng
Mức phù hợp với người mới
84/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.