[jira] [Updated] (KAFKA-12610) Resources on classpath break PluginClassLoader isolation

["Nigel Liang (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KAFKA-12610?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Nigel Liang updated KAFKA-12610:
--------------------------------
    Description: 
The `PluginClassLoader` does not override `getResource` method it inherits from `ClassLoader` . The default implementation searches for resources in parent loader before calling its own `findResource` method. The result of this is that connectors or dependencies of connectors attempting to read resources in jars that may exist on the classpath get the version of the resource from the jar on classpath instead of from the jar in pluginpath.

I have put together a testcase to demonstrate this issue at https://github.com/ncliang/get-resource-example/blob/classpath-resource-leaks/src/test/java/com/nigelliang/PluginClassLoaderTest.java

  was:
The `PluginClassLoader` does not override `getResource` method it inherits from `ClassLoader` . The default implementation searches for resources in parent loader before calling its own `findResource` method. The result of this is that connectors or dependencies of connectors attempting to read resources in jars that may exist on the classpath get the version of the resource from the jar on classpath instead of from the jar in pluginpath.

I have put together a testcase to demonstrate this issue at https://github.com/ncliang/get-resource-example/blob/classpath-resource-leaks/src/test/java/com/nigelliang/PluginClassLoaderTest.java

A manifestation of this bug is in Spanner sink connector, which depends on `google-api-client` . When Google changed the method of determining versions from being hardcoded in a static code [block|https://github.com/googleapis/google-api-java-client/blob/v1.30.2/google-api-client/src/main/java/com/google/api/client/googleapis/GoogleUtils.java#L38] to being read from a [resource|https://github.com/googleapis/google-api-java-client/blob/master/google-api-client/src/main/java/com/google/api/client/googleapis/GoogleUtils.java#L96], the version read from the connector became the (older) version packaged with AK rather than the version packaged with the connector.


> Resources on classpath break PluginClassLoader isolation
> --------------------------------------------------------
>
>                 Key: KAFKA-12610
>                 URL: https://issues.apache.org/jira/browse/KAFKA-12610
>             Project: Kafka
>          Issue Type: Bug
>    Affects Versions: 2.3.1, 2.4.1, 2.5.1, 2.7.0, 2.6.1
>            Reporter: Nigel Liang
>            Assignee: Nigel Liang
>            Priority: Major
>              Labels: connect
>
> The `PluginClassLoader` does not override `getResource` method it inherits from `ClassLoader` . The default implementation searches for resources in parent loader before calling its own `findResource` method. The result of this is that connectors or dependencies of connectors attempting to read resources in jars that may exist on the classpath get the version of the resource from the jar on classpath instead of from the jar in pluginpath.
> I have put together a testcase to demonstrate this issue at https://github.com/ncliang/get-resource-example/blob/classpath-resource-leaks/src/test/java/com/nigelliang/PluginClassLoaderTest.java



--
This message was sent by Atlassian Jira
(v8.3.4#803005)