elharo opened a new issue, #12607:
URL: https://github.com/apache/maven/issues/12607
# DefaultMaven: Session scope leak on constructor exception
**Found in:** maven-4.0.x branch
**File:** `impl/maven-core/src/main/java/org/apache/maven/DefaultMaven.java`
(lines 213-216)
**Severity:** Medium
## Description
`sessionScope.enter()` is called **outside** the try-finally block:
```java
sessionScope.enter();
MavenChainedWorkspaceReader chainedWorkspaceReader =
new MavenChainedWorkspaceReader(request.getWorkspaceReader(),
ideWorkspaceReader);
try (CloseableSession closeableSession = ...) {
...
} finally {
sessionScope.exit();
}
```
If the constructor `new MavenChainedWorkspaceReader(...)` at lines 214-215
throws any exception, the `sessionScope.exit()` in the finally block will
**never** execute. This leaks the session scope's thread-local state. The
`ideWorkspaceReader` parameter is `@Nullable`, and the constructor delegates to
`setReaders()` which could throw.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
