Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeException

Open Beginner friendly
#2,177 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
networking

Research direction

Start in google-http-client/src/main/java/com/google/api/client/http/HttpRequest.java, focusing on HttpRequest.execute() and its finally block. Reproduce the failure with a LowLevelHttpResponse whose getContentEncoding() throws, then run testExecute_disconnectOnResponseConstructionFailure. Done means the low-level response is disconnected when response construction fails and the regression test passes.

Written by the indexing model from the issue text.

Description

Environment details:

  1. Core — HttpRequest.execute() in google-http-client
  2. OS type and version: Any (not OS-specific)
  3. Java version: Any (reproduces on Java 8+)
  4. google-http-client version(s): reproducible on current main

Steps to reproduce:

  1. Implement a LowLevelHttpResponse whose getContentEncoding() throws a RuntimeException.
  2. Execute an HttpRequest against that transport.
  3. Catch the RuntimeException from execute().
  4. Observe disconnect() was never called on the low-level response.

Code example:

MockLowLevelHttpResponse failingResponse = new MockLowLevelHttpResponse() {
  @Override
  public String getContentEncoding() {
    throw new RuntimeException("simulated failure");
  }
};

HttpTransport transport = new MockHttpTransport() {
  @Override
  public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
    return new MockLowLevelHttpRequest().setResponse(failingResponse);
  }
};

HttpRequest req = transport.createRequestFactory()
    .buildGetRequest(new GenericUrl("http://example.com"));

try {
  req.execute();
} catch (RuntimeException e) {
  // failingResponse.isDisconnected() == false  <-- BUG: socket leaked
}

Stack trace:
None — silent resource leak, not a crash. The RuntimeException propagates as expected; the
bug is that execute()'s finally block never calls LowLevelHttpResponse#disconnect() here.

External references:

  • HttpRequest#execute(): google-http-client/src/main/java/com/google/api/client/http/HttpRequest.java

Any additional information:
Under sustained error conditions, leaked connections accumulate until the pool is exhausted,
risking DoS/thread starvation. Pre-existing bug, unrelated to security hardening — found
opportunistically during a security audit of this file.

Proposed fix — in execute()'s finally block, add a guarded disconnect():

} finally {
  if (!responseConstructed && lowLevelHttpResponse != null) {
    try {
      InputStream c = lowLevelHttpResponse.getContent();
      if (c != null) c.close();
    } catch (IOException ignored) {}
    try {
      lowLevelHttpResponse.disconnect();
    } catch (IOException ignored) {}
  }
}

Regression test testExecute_disconnectOnResponseConstructionFailure included in the
accompanying PR.

Dominant language
Java
Stars
1.4k
Forks
473
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from googleapis/google-http-java-client

All issues in googleapis/google-http-java-client

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.