Potential out-of-memory in AbstractSockJsService [SPR-10893]

[spring-projects-issues]

Sergey Shcherbakov opened SPR-10893 and commented

The knownSockJsPrefixes set grows with every distinctive request path and gets never cleared in the AbstractSockJsService.
This actually presents a potential memory leakage and "out of memory" attack threat.
This may happen when the client uses unique paths in requests to connect to SockJS service and validSockJsPrefixes list is configured to be empty to handle SockJS HTTPs requests with dynamic path.

---

Affects: 4.0 M3

Referenced from: commits 02cb866

[spring-projects-issues]

Rossen Stoyanchev commented

There is now an upper limit (100) on the number of known prefixes that can be cached. Once reached, the oldest entry is thrown out, so that effectively only a fixed number can be cached at a time.