[
https://issues.apache.org/jira/browse/SLING-13353?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Angela Schreiber updated SLING-13353:
-------------------------------------
Fix Version/s: Auth Core 2.1.0
> SlingAuthenticator: unbounded handleLoginFailure <-> getAnonymousResolver
> recursion when anonymous login repeatedly fails
> -------------------------------------------------------------------------------------------------------------------------
>
> Key: SLING-13353
> URL: https://issues.apache.org/jira/browse/SLING-13353
> Project: Sling
> Issue Type: Bug
> Affects Versions: Auth Core 2.0.2
> Reporter: Rishabh Daim
> Assignee: Rishabh Daim
> Priority: Major
> Fix For: Auth Core 2.1.0
>
>
> h4. Problem
> {{SlingAuthenticator}} recurses without bound between {{handleLoginFailure}}
> and {{getAnonymousResolver}} when acquiring the anonymous
> {{ResourceResolver}} keeps failing with {{LoginException}} (e.g. the backing
> repository is unavailable). The stack grows until {{StackOverflowError}}, and
> since each failed request logs the full repeating trace, a sustained failure
> floods the error log (observed in the field growing until the disk filled).
> h4. Cause
> In {{org.apache.sling.auth.core.impl.SlingAuthenticator}}, the two methods
> call each other with no termination guard:
> * {{getAnonymousResolver}}: on {{LoginException}} from
> {{getResourceResolver}}, calls {{handleLoginFailure}};
> * {{handleLoginFailure}}: for a {{LoginException}} with anonymous access
> still allowed, calls {{getAnonymousResolver}}.
> So {{getAnonymousResolver -> handleLoginFailure -> getAnonymousResolver ->
> ...}} repeats as long as the anonymous login keeps failing. The anonymous
> fallback is never marked as already-attempted.
> h4. Reproduce
> Anonymous access allowed; make {{getResourceResolver}} throw
> {{LoginException}}; issue a plain request to an anonymous path. Expected: one
> anonymous attempt, then terminate. Actual: recursion to
> {{StackOverflowError}}.
> h4. Fix
> Per-request re-entrancy guard: {{getAnonymousResolver}} marks (request
> attribute) that anonymous resolution was attempted; {{handleLoginFailure}}
> only falls back when the mark is absent - at most one attempt per request,
> terminating normally on repeated failure. All currently-successful paths
> (including a single legitimate anonymous fallback) are unchanged. Regression
> test drives repeated {{LoginException}} and asserts no {{StackOverflowError}}
> and exactly one {{getResourceResolver}} call; it fails without the guard.
> Affects current trunk (auth-core bundle 66) and earlier releases with the
> same structure.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
