java - 在 AccessDeniedException 上检测到 Jackrabbit 未关闭的 session ，但 session 为空

Question

我正在使用 Jackrabbit 2.13.1。

为什么AccessDeniedException会导致 session 泄露？

        try {
            session = repository.login(creds); //here are creds for user without permissions, just for testing
        } catch (Throwable t) {
            if (session != null) {
                session.logout();
            }
            Throwables.propagateIfInstanceOf(t, javax.jcr.RepositoryException.class);
            throw Throwables.propagate(t);
        }

如预期的那样抛出 AccessDeniedException:

Caused by: javax.jcr.LoginException: Workspace access denied
    at org.apache.jackrabbit.core.RepositoryImpl.login(RepositoryImpl.java:1529)
    at org.apache.jackrabbit.commons.AbstractRepository.login(AbstractRepository.java:144)
    at ttt.createSession(RepositoryManager.java:132)
    ... 51 common frames omitted

Caused by: javax.jcr.AccessDeniedException: Not allowed to access Workspace default
    at org.apache.jackrabbit.core.security.DefaultAccessManager.init(DefaultAccessManager.java:159)
    at org.apache.jackrabbit.core.DefaultSecurityManager.getAccessManager(DefaultSecurityManager.java:280)
    at org.apache.jackrabbit.core.SessionImpl.createAccessManager(SessionImpl.java:356)
    at org.apache.jackrabbit.core.SessionImpl.<init>(SessionImpl.java:273)
    at org.apache.jackrabbit.core.SessionImpl.<init>(SessionImpl.java:239)
    at org.apache.jackrabbit.core.XASessionImpl.<init>(XASessionImpl.java:101)
    at org.apache.jackrabbit.core.RepositoryImpl.createSessionInstance(RepositoryImpl.java:1613)
    at org.apache.jackrabbit.core.RepositoryImpl.createSession(RepositoryImpl.java:956)
    at org.apache.jackrabbit.core.RepositoryImpl.login(RepositoryImpl.java:1501)

session 为空，因此我无法对其调用注销。但是未关闭的 session 检测到异常被抛出:

WARN  o.a.jackrabbit.core.SessionImpl - Unclosed session detected. The session was opened here: 
java.lang.Exception: Stack Trace
    at org.apache.jackrabbit.core.SessionImpl.<init>(SessionImpl.java:222)
    at org.apache.jackrabbit.core.SessionImpl.<init>(SessionImpl.java:239)
    at org.apache.jackrabbit.core.XASessionImpl.<init>(XASessionImpl.java:101)
    at org.apache.jackrabbit.core.RepositoryImpl.createSessionInstance(RepositoryImpl.java:1613)
    at org.apache.jackrabbit.core.RepositoryImpl.createSession(RepositoryImpl.java:956)
    at org.apache.jackrabbit.core.RepositoryImpl.login(RepositoryImpl.java:1501)
    at org.apache.jackrabbit.commons.AbstractRepository.login(AbstractRepository.java:144)
    at ttt.createSession(RepositoryManager.java:132)

Answer 1

很好，这听起来显然是一个错误，它仍然存在于 2.13.3 中，并且在 SessionImpl 的构造函数中抛出异常时发生，然后部分创建了 session ，但它仍然被认为是 Activity 的，并且即将被 GCed 的实时 session 被当前代码视为 session 泄漏，这就是您收到此警告的原因。

我刚刚为此 https://issues.apache.org/jira/browse/JCR-4033 创建了一张票