[jira] [Commented] (FILEUPLOAD-189) DiskFileItemFactory use of FileCleaningTracker is documated or coded wrong

["Jan Novotný (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FILEUPLOAD-189?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13459006#comment-13459006 ] 

Jan Novotný commented on FILEUPLOAD-189:
----------------------------------------

I think this issue should be considered as Critical. DiskFileItemFactory is usually used as singleton object and thus this behaviour leads to OutOfMemory exceptions, because file tracker never removes corresponding temp files and list of tracker only gets bigger and bigger. We noticed this problem when our server passed through several crashes due to OOM when someone started penetration test on our site which uploaded files through publicly accessible form.
                
> DiskFileItemFactory use of FileCleaningTracker is documated or coded wrong
> --------------------------------------------------------------------------
>
>                 Key: FILEUPLOAD-189
>                 URL: https://issues.apache.org/jira/browse/FILEUPLOAD-189
>             Project: Commons FileUpload
>          Issue Type: Bug
>            Reporter: Gregor K
>            Priority: Minor
>   Original Estimate: 1h
>  Remaining Estimate: 1h
>
> Regarding latest SVN revision:
> The DiskFileItemFactory documents:
> Temporary files are automatically deleted as soon as they are no longer needed. (More precisely, when the corresponding instance of {@link java.io.File} is garbage collected.)
> But the code in DiskFileItemFactory.createItem() is doing:
> tracker.track(result.getTempFile(), this);
> Which means the file is cleaned when DiskFileItemFactory is garbage collected.
> This error is propably introduced in Rev 578253 when the code was moved from DiskFileItem to DiskFileItemFactory, without changing "this" (which was DiskFileItem) and is not DiskFileItemFactory.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira