[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-45 - Leaks in HTTP response handling

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=fe52c52ecedd5c2d9920f6f4714789665f91968a

The following commit(s) were added to refs/heads/main by this push:
     new fe52c52  JOIDCRP-45 - Leaks in HTTP response handling
fe52c52 is described below

commit fe52c52ecedd5c2d9920f6f4714789665f91968a
Author: philipsmart <philipsmart at 192.168.1.103>
AuthorDate: Mon Aug 28 21:40:35 2023 +0100

    JOIDCRP-45 - Leaks in HTTP response handling
    
     - Add try-with-resources to ClassicalHttpResponse.
    
    https://shibboleth.atlassian.net/browse/JOIDCRP-45
---
 .../rp/impl/AbstractHttpOIDCAuthenticationAction.java | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
index e670021..77facee 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AbstractHttpOIDCAuthenticationAction.java
@@ -167,14 +167,15 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T extends Response>
             if (request == null) {
                 throw new OIDCRPException("Unable to encode HTTP request");
             }
-            final ClassicHttpResponse response = executeHttpRequest(request, authenticatableContext);
-            final T responseObject = getHttpResponseDecoderStrategy().apply(response);
-            if (responseObject == null) {
-                throw new OIDCRPException("Unable to process HTTP response");                
-            } else if (!responseObject.indicatesSuccess()) {
-                throw new OIDCRPException(formatErrorResponse(((ErrorResponse)responseObject).getErrorObject()));
+            try (ClassicHttpResponse response = executeHttpRequest(request, authenticatableContext)){
+                final T responseObject = getHttpResponseDecoderStrategy().apply(response);
+                if (responseObject == null) {
+                    throw new OIDCRPException("Unable to process HTTP response");                
+                } else if (!responseObject.indicatesSuccess()) {
+                    throw new OIDCRPException(formatErrorResponse(((ErrorResponse)responseObject).getErrorObject()));
+                }
+                return responseObject;
             }
-            return responseObject;
         } catch (final IOException e) {
             log.error("{} Unable to perform HTTP request and return response",getLogPrefix(),e);
             throw new OIDCRPException(e);
@@ -206,11 +207,13 @@ public abstract class AbstractHttpOIDCAuthenticationAction<T extends Response>
     /**
      * Performs a call to an HTTP endpoint using the configured HttpClient and security parameters.
      * 
+     * <p>Note, it is the responsibility of the caller to ensure the response is consumed and closed.</p>
+     * 
      * @param request the prepared HTTP request
      * @param authenticatableContext an authenticatable context to set the authenticated flag. Can be {@literal null} if
      *                                  no flag is supplied.
      * 
-     * @return the HTTP response, never {@code null}.
+     * @return the HTTP response, never {@code null}. The response will remain open until closed.
      * 
      * @throws IOException if there is an error producing a response
      */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.