[jira] [Created] (THRIFT-4923) An information leakage from TIOStreamTransport

["xiaoqin.fu (JIRA)" <ji...@apache.org>]

xiaoqin.fu created THRIFT-4923:
----------------------------------

             Summary: An information leakage from TIOStreamTransport
                 Key: THRIFT-4923
                 URL: https://issues.apache.org/jira/browse/THRIFT-4923
             Project: Thrift
          Issue Type: Bug
          Components: Java - Library
    Affects Versions: 0.12.0, 0.11.0
         Environment: Ubuntu 16.04.3 LTS
Open JDK version "1.8.0_191" build 25.191-b12  
            Reporter: xiaoqin.fu


In org.apache.thrift.transport.TIOStreamTransport,
  public void close() {
    if (inputStream_ != null) {
      try {
        inputStream_.close();
      } catch (IOException iox) {
        LOGGER.warn("Error closing input stream.", iox);
      }
      inputStream_ = null;
    }
    if (outputStream_ != null) {
      try {
        outputStream_.close();
      } catch (IOException iox) {
        LOGGER.warn("Error closing output stream.", iox);
      }
      outputStream_ = null;
    }
  }
Sensitive information about socket input stream or output stream is leaked. The LOGGER.isWarnEnabled() conditional statement should be added:
  public void close() {
    if (inputStream_ != null) {
      try {
		inputStream_.close();
      } catch (IOException iox) {
		if (LOGGER.isWarnEnabled())
			LOGGER.warn("Error closing input stream.", iox);
      }
      inputStream_ = null;
    }
    if (outputStream_ != null) {
      try {
		outputStream_.close();
      } catch (IOException iox) {
		if (LOGGER.isWarnEnabled())
			LOGGER.warn("Error closing output stream.", iox);
      }
      outputStream_ = null;
    }
  }



--
This message was sent by Atlassian JIRA
(v7.6.14#76016)