)]}'
{
  "commit": "b34da26abc259a239fe3828c6bf37ebb47016d8c",
  "tree": "e156913ec649adb03a33bde097f4f60307c18618",
  "parents": [
    "a39ed53e0f6ed95ff6c0e6de8dccf7ac5b8db849"
  ],
  "author": {
    "name": "Luca Milanesio",
    "email": "luca.milanesio@gmail.com",
    "time": "Fri Aug 25 22:54:51 2023 +0100"
  },
  "committer": {
    "name": "Luca Milanesio",
    "email": "luca.milanesio@gmail.com",
    "time": "Sun Aug 27 10:31:42 2023 +0100"
  },
  "message": "Fix HTTP session leaks during OAuth reauthentication\n\nWhen an existing Gerrit session expires or the user\nis signing out explicitly, the underlying HTTP session\nremains active because of the JSESSIONID cookie being\npreserved on the client. The situation was detected by\nthe OAuthWebFilter which was trying to resolve it by\ninvalidating the HTTP session explicitly.\n\nBy performing a detailed analysis of the HTTP sessions\nand the GitHubLogin objects leaks, it is clear that\nthe explicit invalidation causes a \"race\" between the\nclient and the server where every single call creates\na new HTTP session object with a GitHubLogin associated\nwhich would never be effectively used, because the\nGerrit login isn\u0027t completed and therefore the Gerrit\nsession is not finalised yet.\n\nIt is incorrect to expire the JSESSIONID if the\nclient still holds a cooking pointer to it, but the\nexisting session can be simply \"cleaned up\" by the\nGitHub and Gerrit account information that aren\u0027t\nknown yet, so that no more objects are created and\nleaked.\n\nAfter the fix, there is exactly one GitHubLogin\nobject created per OAuth authentication phase vs.\ntens of them which was the previous situation.\n\nBug: Issue 40015390\nChange-Id: Ieff58fa48c9eb8cca6a90524fa616de9564767f5\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fdde6480f26d2dbf14477cb25ecf58c6e0a5abcd",
      "old_mode": 33188,
      "old_path": "github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/HttpSessionProvider.java",
      "new_id": "da840bfce8f03bafd407585c3fea0e1e59f3998b",
      "new_mode": 33188,
      "new_path": "github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/HttpSessionProvider.java"
    },
    {
      "type": "modify",
      "old_id": "3c721412df8f207137261236d1dfa9ef75ae0690",
      "old_mode": 33188,
      "old_path": "github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/OAuthWebFilter.java",
      "new_id": "0bca5702e91f792ad1171d1e58a3ece43e664c87",
      "new_mode": 33188,
      "new_path": "github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/OAuthWebFilter.java"
    },
    {
      "type": "modify",
      "old_id": "9c68ddeb5d49fbba12d32f5aa8a226a60bcb220a",
      "old_mode": 33188,
      "old_path": "github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/ScopedProvider.java",
      "new_id": "307a93be11a2c64e7cbfb4be567eead51de35ea2",
      "new_mode": 33188,
      "new_path": "github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/ScopedProvider.java"
    }
  ]
}