Issue #6277 - Protect from Throwables on HttpSessionListener events.

Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
jetty · Sep 30, 2021 · 09d74ab · 09d74ab
1 parent 1846b28
commit 09d74ab
Showing 1 changed file with 20 additions and 5 deletions.
diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/session/AbstractSessionManager.java b/jetty-server/src/main/java/org/eclipse/jetty/server/session/AbstractSessionManager.java
@@ -18,8 +18,6 @@
 
 package org.eclipse.jetty.server.session;
 
-import static java.lang.Math.round;
-
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.Enumeration;
@@ -28,7 +26,6 @@
 import java.util.List;
 import java.util.Set;
 import java.util.concurrent.CopyOnWriteArrayList;
-
 import javax.servlet.SessionCookieConfig;
 import javax.servlet.SessionTrackingMode;
 import javax.servlet.http.HttpServletRequest;
@@ -53,6 +50,8 @@
 import org.eclipse.jetty.util.statistic.CounterStatistic;
 import org.eclipse.jetty.util.statistic.SampleStatistic;
 
+import static java.lang.Math.round;
+
 /**
  * An Abstract implementation of SessionManager.
  * <p>
@@ -703,7 +702,16 @@ protected void addSession(AbstractSession session, boolean created)
             {
                 HttpSessionEvent event=new HttpSessionEvent(session);
                 for (HttpSessionListener listener : _sessionListeners)
-                    listener.sessionCreated(event);
+                {
+                    try
+                    {
+                        listener.sessionCreated(event);
+                    }
+                    catch (Throwable t)
+                    {
+                        __log.warn("Error during Session created listener", t);
+                    }
+                }
             }
         }
     }
@@ -791,7 +799,14 @@ public boolean removeSession(AbstractSession session, boolean invalidate)
                 HttpSessionEvent event=new HttpSessionEvent(session);      
                 for (int i = _sessionListeners.size()-1; i>=0; i--)
                 {
-                    _sessionListeners.get(i).sessionDestroyed(event);
+                    try
+                    {
+                        _sessionListeners.get(i).sessionDestroyed(event);
+                    }
+                    catch(Throwable t)
+                    {
+                        __log.warn("Error during Session destroy listener", t);
+                    }
                 }
             }
         }