CODEWITHSUNDEEP
springspring-restfortify
EyeKay Peter
EyeKay Peter

Reputation: 61

How to correctly instantiate RestTemplate without leaking resources

Please I have the following bean definitions

 @Bean
    public RestTemplate produceRestTemplate(ClientHttpRequestFactory requestFactory){
        RestTemplate restTemplate = new RestTemplate(requestFactory);
        restTemplate.setErrorHandler(restTemplateErrorHandler);
        return restTemplate;
    }

@Bean
public ClientHttpRequestFactory createRequestFactory() {
    PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager();
    connectionManager.setMaxTotal(maxTotalConn);
    connectionManager.setDefaultMaxPerRoute(maxPerChannel);

    RequestConfig config = RequestConfig.custom().setConnectTimeout(100000).build();
    CloseableHttpClient httpClient = HttpClients.createDefault();
    return new HttpComponentsClientHttpRequestFactory(httpClient);
}

The code works well but the problem is that fortify flags the code above as being potentially problematic with the following

"The function createRequestFactory() sometimes fails to release a socket allocated by createDefault() on line 141."

Please anyone with any ideas as to how to correctly do this without fortify raising alarms

Thanks in advance

Upvotes: 5

Views: 4183

Answers (2)

Sabir Khan
Sabir Khan

Reputation: 10132

I am pretty sure that you don't need to do anything. It looks to be a fortify issue that it might not be updated to this usage scenario. There is a mechanism to take exceptions when working with code analyzers - these tools are not always correct.

A Bit of Discussion

Imagine , you are using CloseableHttpClient in a scenario where there would be no @Bean or HttpComponentsClientHttpRequestFactory , then I would say that fortify is correct because that is the very intention of using a java.io.Closeable .

Spring beans are usually singleton with an intention of instance reuse so fortify should know that you are not creating multiple instances and close() method on AutoCloseable would be called when factory is destroyed at shutdown.

if you look at code of - org.springframework.http.client.HttpComponentsClientHttpRequestFactory , this is there. 

/**
     * Shutdown hook that closes the underlying
     * {@link org.apache.http.conn.HttpClientConnectionManager ClientConnectionManager}'s
     * connection pool, if any.
     */
    @Override
    public void destroy() throws Exception {
        if (this.httpClient instanceof Closeable) {
            ((Closeable) this.httpClient).close();
        }
    }

Your fortify is looking at code in isolation and not in integrated way so its flagging.

Upvotes: 4

SPoint
SPoint

Reputation: 600

Check this 2 points, for solving the problem.

  1. If you never call the httpClient.close() method, sometime you can effectivlely run out of socket.

  2. If you're code call this method automatically somewhere there is no vuln and problem.

    Anyway, this could be a FalsePositiv depending of the Version of the Java and Lib you use

Upvotes: 0

Related Questions