Skip to content

@azure/cosmos: request handler - fix 'abortSignal' and event listener memory leak#35428

Merged
jeremymeng merged 1 commit intoAzure:mainfrom
petriposio:fix/cosmos-request-abort-leak
Nov 3, 2025
Merged

@azure/cosmos: request handler - fix 'abortSignal' and event listener memory leak#35428
jeremymeng merged 1 commit intoAzure:mainfrom
petriposio:fix/cosmos-request-abort-leak

Conversation

@petriposio
Copy link
Contributor

@petriposio petriposio commented Aug 1, 2025

Packages impacted by this PR

@azure/cosmos

Issues associated with this PR

Describe the problem that is addressed by this PR

In sdk/cosmosdb/cosmos/src/request/RequestHandler.ts an event listener is added to the abortSignal. The event listener is never removed. This causes a memory leak.

This bug might also eventually lead to the user provided abort signal to be ignored if events.setMaxListeners is configured in NodeJS.

A reproducible example

import { CosmosClient } from "@azure/cosmos";

const endpoint = "https://your-account.documents.azure.com";
const key = "<database account masterkey>";
const client = new CosmosClient({ endpoint, key });

const { database } = await client.databases.createIfNotExists({ id: "Test Database" });
const { container } = await database.containers.createIfNotExists({ id: "Test Container" });

const abortSignal = AbortSignal.timeout(5 * 60 * 1e3);

const query = container.items.query(
  {
    query: "SELECT * FROM c",
  },
  {
    abortSignal,
    maxItemCount: 1,
  }
);

for await (const response of query.getAsyncIterator()) {
  /*
   *
   * The EventListener added to the 'abortSignal' is not removed and thus it is leaking memory
   *
   * In NodeJS unless events.setMaxListeners is set to Infinity, will effectively eventually cause 'abortSignal' to be rejected and ignored
   *
   * MaxListenersExceededWarning: Possible EventTarget memory leak detected. 11 abort listeners added to [AbortSignal]. MaxListeners is 10. Use events.setMaxListeners() to increase limit
   *
   */
// 
}

What are the possible designs available to address the problem? If there are more than one possible design, why was the one in this PR chosen?

Are there test cases added in this PR? (If not, why?)

Provide a list of related PRs (if any)

Command used to generate this PR:**(Applicable only to SDK release request PRs)

Checklists

  • Added impacted package name to the issue description
  • Does this PR needs any fixes in the SDK Generator?** (If so, create an Issue in the Autorest/typescript repository and link it here)
  • Added a changelog (if necessary)

@github-actions github-actions bot added Community Contribution Community members are working on the issue Cosmos customer-reported Issues that are reported by GitHub users external to the Azure organization. labels Aug 1, 2025
@github-actions
Copy link

github-actions bot commented Aug 1, 2025

Thank you for your contribution @petriposio! We will review the pull request and get back to you soon.

@xirzec xirzec requested a review from jeremymeng August 26, 2025 19:47
@xirzec
Copy link
Member

xirzec commented Aug 26, 2025

@jeremymeng I remember you've dealt with similar leaks in the past, does this fix look correct?

@jeremymeng
Copy link
Member

This fix looks good to me. Thanks for your contribution @petriposio!

@amanrao23 @aditishree1 please have a look

@github-actions
Copy link

Hi @petriposio. Thank you for your interest in helping to improve the Azure SDK experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days.

@github-actions github-actions bot added the no-recent-activity There has been no recent activity on this issue. label Oct 31, 2025
@petriposio
Copy link
Contributor Author

Still active. Waiting for a review. Could the code owners have a look, please? Is there anything I can do to get this merged?

@github-actions github-actions bot removed the no-recent-activity There has been no recent activity on this issue. label Oct 31, 2025
@petriposio petriposio force-pushed the fix/cosmos-request-abort-leak branch from e3bece2 to 7e9ee48 Compare November 3, 2025 09:30
Copy link
Member

@aditishree1 aditishree1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jeremymeng jeremymeng merged commit 6b2a30a into Azure:main Nov 3, 2025
10 checks passed
deyaaeldeen added a commit that referenced this pull request Mar 5, 2026
Extracts the suspicious-PR detection logic from the workflow's inline
bash into a proper TypeScript module at eng/tools/detect-suspicious-pr/
with full test coverage.

Structure:
  src/detect.ts  – pure detection functions (checkInjection, checkCiFiles,
                   checkLifecyclePatch, detectSuspiciousPR)
  src/run.ts     – CLI entry point: reads JSON from stdin, exits 1 if
                   suspicious
  src/index.ts   – public re-exports
  test/detect.test.ts – 124 vitest tests across 6 suites

The workflow now:
  1. Sparse-checks out the detection tool from the base branch
  2. Installs its deps with npm
  3. Gathers PR metadata via gh CLI and builds a JSON payload
  4. Pipes it to the TypeScript detector via tsx
  5. Closes the PR if the detector exits non-zero

Tests cover:
  - 35 malicious branch name patterns (injection, PS, shell, URLs, etc.)
  - 15 benign branch names (including real merged community PRs)
  - 12 malicious + 10 benign PR titles
  - 4 commit message cases
  - 9 protected CI/CD paths + 4 registry/build configs + 10 safe paths
  - 10 malicious + 6 benign npm lifecycle patches
  - 8 end-to-end integration scenarios (real PR #37419, #37403, #35428)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Community Contribution Community members are working on the issue Cosmos customer-reported Issues that are reported by GitHub users external to the Azure organization.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants