SebTardif opened a new pull request, #4218:
URL: https://github.com/apache/logging-log4j2/pull/4218
## What Problem This Solves
`LoggerContextAdmin.setConfigLocationUri` opened a `FileInputStream` or URL
stream and passed it to `ConfigurationSource(InputStream, File/URL)`. That
constructor documents that **the caller owns the stream**. On some failure
paths before the configuration parser closes the stream, the descriptor can
leak. Same theme as the ConfigurationSource URL leak work in #4127.
## Evidence
### Failure scenario
```java
configSource = new ConfigurationSource(new FileInputStream(configFile),
configFile);
// if getConfiguration/start fails before the config impl closes the stream,
// the FileInputStream remains open
```
### Fix
Buffer the configuration into memory with try-with-resources, then construct
a `ConfigurationSource(Source, byte[], lastModified)` that owns a
`ByteArrayInputStream`.
### Red-green / tests
```bash
export JAVA_HOME=$(/usr/libexec/java_home -v 17)
./mvnw -pl log4j-core,log4j-core-test -am test \
-Dtest=LoggerContextAdminSetConfigLocationUriTest \
-Dsurefire.failIfNoSpecifiedTests=false
```
Result: 3 tests pass (valid file reconfigure, `file:` URL form, blank
rejection).
## Summary
- Buffer + close file/URL streams in `setConfigLocationUri`
- Regression tests in `LoggerContextAdminSetConfigLocationUriTest`
- Changelog entry
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
