[SLING-7591] Session leak when a ResourceResolver is created from a Session then gets cloned

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: JCR Resource 3.0.8
• Fix Version/s: JCR Resource 3.0.14
• Component/s: JCR
• Assignee: Carsten Ziegeler
• Reporter: Csaba Varga
• Created: 17/Apr/18 17:59
• Updated: 03/Aug/18 13:10
• Resolved: 24/Apr/18 17:53

Description

The following steps will cause a new JCR session to be opened then leaked:

1. Create a ResourceResolver out of an existing JCR session (using AUTHENTICATION_INFO_SESSION)
2. Call clone() on the ResourceResolver created in step 1, passing the ResourceResolverFactory.USER_IMPERSONATION key with a username to impersonate
3. Close the ResourceResolver created in step 2.

The expected behavior is that since step 2 opened a new JCR Session in the background, step 3 should close it. The actual behavior is that the JCR session stays open without an obvious way to close it, and these leaked sessions can pile up if this sequence is executed often.