This is an automated email from the ASF dual-hosted git repository.
Jackie-Jiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new c5f7bda6aed Fix InputStream leak in RenewableTlsUtils.createSSLFactory
(#18483)
c5f7bda6aed is described below
commit c5f7bda6aed8cb3820332e9b4dfc122aec1fd67c
Author: Deepak kumar <[email protected]>
AuthorDate: Tue Aug 4 18:56:33 2026 -0700
Fix InputStream leak in RenewableTlsUtils.createSSLFactory (#18483)
---
.../pinot/common/utils/tls/RenewableTlsUtils.java | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
diff --git
a/pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java
b/pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java
index 1abfdf883a2..f3e19e52220 100644
---
a/pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java
+++
b/pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java
@@ -110,15 +110,14 @@ public class RenewableTlsUtils {
String sslContextProtocol, SecureRandom secureRandom, boolean
keyAndTrustMaterialSwappable, boolean isInsecure) {
try {
SSLFactory.Builder sslFactoryBuilder = SSLFactory.builder();
- InputStream keyStoreStream = null;
- InputStream trustStoreStream = null;
if (keyStorePath != null) {
Preconditions.checkNotNull(keyStorePassword, "key store password must
not be null");
- keyStoreStream =
TlsUtils.makeKeyOrTrustStoreUrl(keyStorePath).openStream();
if (keyAndTrustMaterialSwappable) {
sslFactoryBuilder.withSwappableIdentityMaterial();
}
- sslFactoryBuilder.withIdentityMaterial(keyStoreStream,
keyStorePassword.toCharArray(), keyStoreType);
+ try (InputStream keyStoreStream =
TlsUtils.makeKeyOrTrustStoreUrl(keyStorePath).openStream()) {
+ sslFactoryBuilder.withIdentityMaterial(keyStoreStream,
keyStorePassword.toCharArray(), keyStoreType);
+ }
}
if (isInsecure) {
if (keyAndTrustMaterialSwappable) {
@@ -127,11 +126,12 @@ public class RenewableTlsUtils {
sslFactoryBuilder.withUnsafeTrustMaterial();
} else if (trustStorePath != null) {
Preconditions.checkNotNull(trustStorePassword, "trust store password
must not be null");
- trustStoreStream =
TlsUtils.makeKeyOrTrustStoreUrl(trustStorePath).openStream();
if (keyAndTrustMaterialSwappable) {
sslFactoryBuilder.withSwappableTrustMaterial();
}
- sslFactoryBuilder.withTrustMaterial(trustStoreStream,
trustStorePassword.toCharArray(), trustStoreType);
+ try (InputStream trustStoreStream =
TlsUtils.makeKeyOrTrustStoreUrl(trustStorePath).openStream()) {
+ sslFactoryBuilder.withTrustMaterial(trustStoreStream,
trustStorePassword.toCharArray(), trustStoreType);
+ }
}
if (sslContextProtocol != null) {
sslFactoryBuilder.withSslContextAlgorithm(sslContextProtocol);
@@ -140,12 +140,6 @@ public class RenewableTlsUtils {
sslFactoryBuilder.withSecureRandom(secureRandom);
}
SSLFactory sslFactory = sslFactoryBuilder.build();
- if (keyStoreStream != null) {
- keyStoreStream.close();
- }
- if (trustStoreStream != null) {
- trustStoreStream.close();
- }
LOGGER.info("Successfully created SSLFactory {} with key store {} and
trust store {}. "
+ "Key and trust material swappable: {}",
sslFactory, keyStorePath, trustStorePath,
keyAndTrustMaterialSwappable);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
