Skip to content

Disconnect HttpURLConnection in AbstractFileResolvingResource#36773

Open
SebTardif wants to merge 1 commit into
spring-projects:mainfrom
SebTardif:fix/urlconnection-leak-abstractfileresolvingresource
Open

Disconnect HttpURLConnection in AbstractFileResolvingResource#36773
SebTardif wants to merge 1 commit into
spring-projects:mainfrom
SebTardif:fix/urlconnection-leak-abstractfileresolvingresource

Conversation

@SebTardif
Copy link
Copy Markdown

Summary

Ensure HttpURLConnection instances are always disconnected in AbstractFileResolvingResource's exists(), checkReadable(), contentLength(), and lastModified() methods.

Problem

These four methods open URLConnection instances via url.openConnection() that are never disconnected on most code paths. This leaks underlying sockets when resources are accessed over HTTP.

Additionally, on the 405 (Method Not Allowed) retry paths, the original connection reference is silently overwritten when a new connection is opened — the original connection is leaked since no reference to it remains.

This class is the base for ClassPathResource, UrlResource, and all classpath/URL resources in Spring, so any code checking resource existence, readability, content length, or last-modified over HTTP is affected.

Fix

  • Wrap HTTP connection usage in try-finally blocks to ensure disconnect() is always called regardless of which code path is taken
  • Explicitly disconnect the original connection before opening a retry connection on 405 paths
  • Set httpCon = null when a retry yields a non-HTTP connection to avoid disconnecting a stale reference

No behavioral changes — only resource cleanup is added.

The exists(), checkReadable(), contentLength(), and lastModified()
methods open URLConnection instances that are never disconnected on
most code paths. On the 405 (Method Not Allowed) retry paths, the
original connection reference is silently overwritten when a new
connection is opened, leaking the original.

Wrap HTTP connection usage in try-finally blocks to ensure
disconnect() is always called, and explicitly disconnect the
original connection before opening a retry connection.

Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label May 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged or decided on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants