jruby / jruby-rack

Rack for JRuby and Java appservers
MIT License
397 stars 137 forks source link

Infinite loop when obtaining the session #215

Open smellsblue opened 6 years ago

smellsblue commented 6 years ago

I have discovered an infinite loop possibility in JRuby::Rack::Session::SessionStore: https://github.com/jruby/jruby-rack/blob/5854db81cba68ec828908ca1cb646b896faeec64/src/main/ruby/jruby/rack/session_store.rb#L85-L101

In the Java EE documentation for HttpServletRequest#getSession(boolean create), it says:

If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.

We have found ourselves in this situation, and so in the get_servlet_session method linked above, line 94 calls getSession(true) which ends up throwing an IllegalStateException. This gets caught on line 97, and then retried on line 98. Nothing changes, and so this loop will continue forever.

I haven't investigated exactly why our response is committed at the time this gets called (I suspect it is a redirect happening in a Tomcat request filter), so it might be that we are doing something silly that ends up causing this infinite loop, but it still seems like this code should not be possible to enter in an infinite loop.

I have fixed the issue in our system with a monkeypatch and verified that the infinite loop isn't happening anymore, so I will submit a PR with how I solved it.