[
https://issues.apache.org/jira/browse/GROOVY-8113?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135333#comment-18135333
]
ASF GitHub Bot commented on GROOVY-8113:
----------------------------------------
github-advanced-security[bot] commented on code in PR #3109:
URL: https://github.com/apache/groovy/pull/3109#discussion_r4426396329
##########
src/main/java/groovy/lang/GroovyClassLoader.java:
##########
@@ -579,7 +589,114 @@
* @see #clearCache()
*/
protected void removeClassCacheEntry(final String name) {
- classCache.remove(name);
+ if (classCache.remove(name) != null) {
+ noteRemovedSimpleName(name);
+ }
+ }
+
+ /**
+ * Beans introspection and inner-class resolution ask for companion names
+ * that are not on any classpath. {@code Class.forName} of a beans
companion
+ * retries the platform loader when this loader reports
+ * {@link ClassNotFoundException}, so that probe is reported as a different
+ * exception the introspector already ignores. Other known misses stay a
+ * normal {@link ClassNotFoundException}, without consulting the parent.
+ */
+ private void throwIfParentWouldOnlyRecordAMiss(final String name, final
boolean lookupScriptFiles) throws ClassNotFoundException {
+ if (name == null) {
+ return;
+ }
+ boolean beanCompanion = isBeanCompanionProbe(name);
+ boolean innerName = name.indexOf('$') >= 0;
+ if (!beanCompanion && !innerName) {
+ return;
+ }
+ if (definedByParentGroovyLoader(name) || hasClassResource(name)) {
+ return;
+ }
+ if (lookupScriptFiles) {
+ try {
+ if (resourceLoader.loadGroovySource(name) != null) {
+ return;
+ }
+ } catch (MalformedURLException ignored) {
+ // Let the normal load path report the bad source URL.
+ return;
+ }
+ }
+ if (beanCompanion) {
+ throw new IntrospectionProbeMiss(name);
+ }
+ throw new ClassNotFoundException(name);
+ }
+
+ private boolean hasClassResource(final String name) {
+ return getResource(name.replace('.', '/') + ".class") != null;
Review Comment:
## CodeQL / Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/groovy/security/code-scanning/284)
> Groovy script/template engine produce memory leak
> --------------------------------------------------
>
> Key: GROOVY-8113
> URL: https://issues.apache.org/jira/browse/GROOVY-8113
> Project: Groovy
> Issue Type: Bug
> Components: groovy-templates, GroovyScriptEngine
> Affects Versions: 2.4.8
> Environment: Groovy 2.4.8, Oracle Java JDK 8u121
> Reporter: Artyom Kravchenko
> Priority: Critical
> Attachments: merged_path.png, object_explorer.png
>
>
> There is a simple way to produce OutOfMemoryException if run infinite
> numbers of groovy scripts or evaluate groovy templates.
> Simple test to reproduce a memory leak(run groovy script and make template
> inside the script):
> set max heap size: -Xmx7m
> {code:java}
> import javax.script.*;
> import java.util.HashMap;
> import java.util.Map;
> public class OutOfMemoryTest {
> private static String TEMPLATE = "Dear ${fullName} please go away at
> ${time}";
> private static String SCRIPT = "def run(args) {\n" +
> "def bindings = ['fullName' : 'Ali Baba', 'time' : new Date()]\n"
> +
> "println
> args.templateEngine.createTemplate(args.template).make(bindings).toString()\n"
> +
> "}";
> public static void main(String... args) {
> //
> GroovySystem.getMetaClassRegistry().getMetaClassCreationHandler().setDisableCustomMetaClassLookup(true);
> while(true) {
> ScriptEngineManager engineManager = new ScriptEngineManager();
> ScriptEngine engine = engineManager.getEngineByName("groovy");
> try {
> engine.eval(SCRIPT);
> } catch (ScriptException e) {
> throw new RuntimeException(e);
> }
> groovy.text.SimpleTemplateEngine templateEngine = new
> groovy.text.SimpleTemplateEngine();
> Invocable inv = (Invocable) engine;
> Map<String, Object> params = new HashMap<>();
> params.put("template", TEMPLATE);
> params.put("templateEngine", templateEngine);
> Object[] runArgs = { params };
> try {
> inv.invokeFunction("run", runArgs);
> } catch (ScriptException | NoSuchMethodException e) {
> e.printStackTrace();
> }
> }
> }
> }
> {code}
> The main cause of issue is Java class loader. Two instances:
> sun.misc.Launcher.AppClassLoader and sun.misc.Launcher.ExtClassLoader
> (parent for first one), each of them has a strong reference:
> {code:java}
> ConcurrentHashMap<String, Object> parallelLockMap
> {code}
> It collects all loaded classes (and never releases their) for application
> including newly created script/template classes.
> The main reason of introduction of this reference described here:
> https://blogs.oracle.com/dholmes/entry/parallel_classloading_revisited_fully_concurrent
> For each iteration of my test I see that parallelLockMap grows with 6 new
> entries:
> {code:java}
> groovy.runtime.metaclass.Script94MetaClass
> Script94BeanInfo
> Script94Customizer
> groovy.runtime.metaclass.SimpleTemplateScript94MetaClass
> SimpleTemplateScript94BeanInfo
> SimpleTemplateScript94Customizer
> {code}
> See memory snapshots(attached): objects_explorer, merged_path.
> I have found a partial solution of the issue, if I add this code line to my
> test:
> {code:java}
>
> GroovySystem.getMetaClassRegistry().getMetaClassCreationHandler().setDisableCustomMetaClassLookup(true);
> {code}
> I see that classes like:
> {code:java}
> groovy.runtime.metaclass.Script94MetaClass
> groovy.runtime.metaclass.SimpleTemplateScript94MetaClass
> {code}
> goes away (groovy engine don't ask ClassLoader to find this classes on class
> path therefore such classes are not collected by ClassLoader) but classes
> like
> {code:java}
> Script94BeanInfo
> Script94Customizer
> SimpleTemplateScript94BeanInfo
> SimpleTemplateScript94Customizer
> {code}
> still has affect on memory.
> Dear developers, could you please point me any advice/workarounds for this
> issue. It will be fine to get rig this issue in future releases.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
