[CXF-9190] Fix OpenScanHub findings: race conditions and resource leaks

core/src/main/java/org/apache/cxf/attachment/AttachmentDeserializer.java

@@ -244,10 +244,13 @@ private void cacheStreamedAttachments() throws IOException {
                 if (!ads.isCached()) {
                     ads.cache(message);
                 }
-            } else if (s.getInputStream() instanceof DelegatingInputStream) {
-                cache((DelegatingInputStream) s.getInputStream());
             } else {
-                //assume a normal stream that is already cached
+                InputStream is = s.getInputStream();
+                if (is instanceof DelegatingInputStream) {
+                    cache((DelegatingInputStream) is);
+                } else {
+                    //assume a normal stream that is already cached
+                }
             }
         }
     }

core/src/main/java/org/apache/cxf/bus/extension/ExtensionManagerBus.java

@@ -281,16 +281,16 @@ protected void destroyBeans() {
     }
 
     public void shutdown(boolean wait) {
-        if (state == BusState.SHUTTING_DOWN) {
-            return;
+        synchronized (this) {
+            if (state == BusState.SHUTTING_DOWN) {
+                return;
+            }
+            state = BusState.SHUTTING_DOWN;
         }
         BusLifeCycleManager lifeCycleManager = this.getExtension(BusLifeCycleManager.class);
         if (null != lifeCycleManager) {
             lifeCycleManager.preShutdown();
         }
-        synchronized (this) {
-            state = BusState.SHUTTING_DOWN;
-        }
         destroyBeans();
         synchronized (this) {
             state = BusState.SHUTDOWN;

core/src/main/java/org/apache/cxf/common/util/StreamPrinter.java

@@ -39,13 +39,12 @@ class StreamPrinter extends Thread {
 
     @Override
     public void run() {
-        try {
+        try (InputStreamReader isr = new InputStreamReader(is);
+             BufferedReader br = new BufferedReader(isr)) {
             PrintWriter pw = null;
             if (os != null) {
                 pw = new PrintWriter(os);
             }
-            InputStreamReader isr = new InputStreamReader(is);
-            BufferedReader br = new BufferedReader(isr);
             String line = br.readLine();
             while (line != null) {
                 if (pw != null) {
@@ -58,6 +57,14 @@ public void run() {
             }
         } catch (IOException ioe) {
             throw new RuntimeException(ioe);
+        } finally {
+            try {
+                if (is != null) {
+                    is.close();
+                }
+            } catch (IOException e) {
+                // Ignore close exception
+            }
         }
     }
 }

core/src/main/java/org/apache/cxf/configuration/jsse/SSLUtils.java

@@ -22,9 +22,9 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.security.KeyManagementException;
 import java.security.KeyStore;
 import java.security.NoSuchAlgorithmException;
@@ -196,7 +196,7 @@ protected static byte[] loadFile(String fileName) throws IOException {
         if (fileName == null) {
             return null;
         }
-        Path path = FileSystems.getDefault().getPath(fileName);
+        Path path = Paths.get(fileName);
         return Files.readAllBytes(path);
     }
 

distribution/src/main/release/samples/jax_rs/basic_https/src/main/java/httpsdemo/client/Client.java

@@ -51,7 +51,9 @@ public static void main(String[] args) throws Exception {
         String keyStoreLoc = "src/main/config/clientKeystore.jks";
 
         KeyStore keyStore = KeyStore.getInstance("JKS");
-        keyStore.load(new FileInputStream(keyStoreLoc), "cspass".toCharArray());
+        try (FileInputStream fis = new FileInputStream(keyStoreLoc)) {
+            keyStore.load(fis, "cspass".toCharArray());
+        }
 
         SSLContext sslcontext = SSLContexts.custom()
                 .loadTrustMaterial(keyStore, null)

distribution/src/main/release/samples/jax_rs/search/src/main/java/demo/jaxrs/search/client/Client.java

@@ -99,7 +99,10 @@ private static void uploadToCatalog(final String url, final CloseableHttpClient
 
         final HttpPost post = new HttpPost(url);
         MultipartEntity entity = new MultipartEntity();
-        byte[] bytes = IOUtils.readBytesFromStream(Client.class.getResourceAsStream("/" + filename));
+        byte[] bytes;
+        try (InputStream is = Client.class.getResourceAsStream("/" + filename)) {
+            bytes = IOUtils.readBytesFromStream(is);
+        }
         entity.addPart(filename, new ByteArrayBody(bytes, filename));
 
         post.setEntity(entity);

distribution/src/main/release/samples/jaxws_graalvm_dynamic/client/src/main/java/demo/jaxws/client/DumpingClassLoaderCapturer.java

@@ -35,8 +35,8 @@ public class DumpingClassLoaderCapturer implements GeneratedClassClassLoaderCapt
     private final Map<String, byte[]> classes = new ConcurrentHashMap<>();
 
     public void dumpTo(File file) throws IOException {
-        if (!file.exists()) 
-            Files.createDirectories(file.toPath());{
+        if (!file.exists()) {
+            Files.createDirectories(file.toPath());
         }
 
         if (!file.isDirectory()) {

distribution/src/main/release/samples/js_browser_client_simple/src/main/java/demo/hw/client/Get.java

@@ -46,8 +46,14 @@ public static void main(String[] args) throws Exception {
         System.out.println("Invoking server through HTTP GET to invoke sayHi");
 
         InputStream in = httpConnection.getInputStream();
-        StreamSource source = new StreamSource(in);
-        printSource(source);
+        try {
+            StreamSource source = new StreamSource(in);
+            printSource(source);
+        } finally {
+            if (in != null) {
+                in.close();
+            }
+        }
 
         // Sent HTTP GET request to invoke greetMe FAULT
         target = "http://localhost:9000/SoapContext/SoapPort/greetMe/me/CXF";
@@ -58,14 +64,26 @@ public static void main(String[] args) throws Exception {
 
         try {
             in = httpConnection.getInputStream();
-            source = new StreamSource(in);
-            printSource(source);
+            try {
+                StreamSource source = new StreamSource(in);
+                printSource(source);
+            } finally {
+                if (in != null) {
+                    in.close();
+                }
+            }
         } catch (Exception e) {
             System.err.println("GreetMe Fault: " + e.getMessage());
         }
         InputStream err = httpConnection.getErrorStream();
-        source = new StreamSource(err);
-        printSource(source);
+        if (err != null) {
+            try {
+                StreamSource source = new StreamSource(err);
+                printSource(source);
+            } finally {
+                err.close();
+            }
+        }
 
         // Sent HTTP GET request to invoke greetMe
         target = "http://localhost:9000/SoapContext/SoapPort/greetMe/requestType/CXF";
@@ -75,8 +93,14 @@ public static void main(String[] args) throws Exception {
         System.out.println("Invoking server through HTTP GET to invoke greetMe");
 
         in = httpConnection.getInputStream();
-        source = new StreamSource(in);
-        printSource(source);
+        try {
+            StreamSource source = new StreamSource(in);
+            printSource(source);
+        } finally {
+            if (in != null) {
+                in.close();
+            }
+        }
 
         // Sent HTTP GET request to invoke pingMe
         target = "http://localhost:9000/SoapContext/SoapPort/pingMe";
@@ -87,12 +111,21 @@ public static void main(String[] args) throws Exception {
 
         try {
             in = httpConnection.getInputStream();
+            if (in != null) {
+                in.close();
+            }
         } catch (Exception e) {
             System.out.println("PingMe fault raised");
         }
         err = httpConnection.getErrorStream();
-        source = new StreamSource(err);
-        printSource(source);
+        if (err != null) {
+            try {
+                StreamSource source = new StreamSource(err);
+                printSource(source);
+            } finally {
+                err.close();
+            }
+        }
     }
 
     private static void printSource(Source source) {

rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/AegisContext.java

@@ -18,6 +18,8 @@
  */
 package org.apache.cxf.aegis;
 
+import java.io.IOException;
+import java.io.InputStream;
 import java.lang.reflect.Array;
 import java.lang.reflect.GenericArrayType;
 import java.lang.reflect.ParameterizedType;
@@ -286,9 +288,9 @@ public static boolean schemaImportsUtilityTypes(XmlSchema schema) {
     }
 
     private Document getSchemaDocument(String resourcePath) {
-        try {
-            return StaxUtils.read(getClass().getResourceAsStream(resourcePath));
-        } catch (XMLStreamException e) {
+        try (InputStream is = getClass().getResourceAsStream(resourcePath)) {
+            return StaxUtils.read(is);
+        } catch (XMLStreamException | IOException e) {
             throw new RuntimeException(e);
         }
     }

rt/javascript/javascript-rt/src/main/resources/org/apache/cxf/javascript/cxf-utils.js

@@ -540,7 +540,7 @@ function org_apache_cxf_pad_string(string, len, pad, type) {
 	pad = typeof(pad) == 'string' ? pad : ' ';
 
 	if (type == org_apache_cxf_pad_string_PAD_BOTH) {
-		string = org_apache_cxf_pad_sring(Math.floor(len / 2) + string.length,
+		string = org_apache_cxf_pad_string(Math.floor(len / 2) + string.length,
 				pad, org_apache_cxf_pad_string_PAD_LEFT);
 		return (org_apache_cxf_pad_string(Math.ceil(len / 2) + string.length,
 				pad, org_apache_cxf_pad_string_PAD_RIGHT));

rt/rs/client/src/main/java/org/apache/cxf/jaxrs/client/spec/ClientImpl.java

@@ -67,6 +67,7 @@ public class ClientImpl implements Client {
     private Configurable<Client> configImpl;
     private TLSConfiguration secConfig;
     private boolean closed;
+    private final Object baseClientsLock = new Object();
     private Set<WebClient> baseClients =
         Collections.synchronizedSet(Collections.newSetFromMap(new WeakHashMap<WebClient, Boolean>()));
 
@@ -78,16 +79,15 @@ public ClientImpl(Configuration config,
 
     @Override
     public void close() {
-        if (!closed) {
-            synchronized (baseClients) {
+        synchronized (baseClientsLock) {
+            if (!closed) {
                 for (WebClient wc : baseClients) {
                     wc.close();
                 }
+                baseClients = null;
+                closed = true;
             }
-            baseClients = null;
-            closed = true;
         }
-
     }
 
     @Override

rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/AbstractContentEncryptionAlgorithm.java

@@ -51,24 +51,24 @@ protected AbstractContentEncryptionAlgorithm(byte[] cek, byte[] iv, ContentAlgor
 
     public byte[] getContentEncryptionKey(JweHeaders headers) {
         final byte[] theCek;
-        if (cek == null) {
-            String algoJava = getAlgorithm().getJavaName();
-            SecretKey secretKey = CryptoUtils.getSecretKey(AlgorithmUtils.stripAlgoProperties(algoJava),
-                          getContentEncryptionKeySize(headers));
-            theCek = secretKey.getEncoded();
-            if (generateCekOnce) {
-                synchronized (this) {
+        synchronized (this) {
+            if (cek == null) {
+                String algoJava = getAlgorithm().getJavaName();
+                SecretKey secretKey = CryptoUtils.getSecretKey(AlgorithmUtils.stripAlgoProperties(algoJava),
+                              getContentEncryptionKeySize(headers));
+                theCek = secretKey.getEncoded();
+                if (generateCekOnce) {
                     cek = theCek;
                 }
+                // Clean the key after we're done with it
+                try {
+                    secretKey.destroy();
+                } catch (DestroyFailedException e) {
+                    // ignore
+                }
+            } else {
+                theCek = cek;
             }
-            // Clean the key after we're done with it
-            try {
-                secretKey.destroy();
-            } catch (DestroyFailedException e) {
-                // ignore
-            }
-        } else {
-            theCek = cek;
         }
         return theCek;
     }

rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/client/CodeAuthSupplier.java

@@ -42,16 +42,14 @@ public String getAuthorization(AuthorizationPolicy authPolicy,
                                    URI currentURI,
                                    Message message,
                                    String fullHeader) {
-        if (code != null) {
-            synchronized (tokenSupplier) {
-                if (tokenSupplier.getClientAccessToken().getTokenKey() == null) {
-                    WebClient wc = tokenSupplier.createAccessTokenServiceClient();
-                    ClientAccessToken at = OAuthClientUtils.getAccessToken(wc,
-                                                    tokenSupplier.getConsumer(),
-                                                    new AuthorizationCodeGrant(code));
-                    code = null;
-                    tokenSupplier.setClientAccessToken(at);
-                }
+        synchronized (tokenSupplier) {
+            if (code != null && tokenSupplier.getClientAccessToken().getTokenKey() == null) {
+                WebClient wc = tokenSupplier.createAccessTokenServiceClient();
+                ClientAccessToken at = OAuthClientUtils.getAccessToken(wc,
+                                                tokenSupplier.getConsumer(),
+                                                new AuthorizationCodeGrant(code));
+                code = null;
+                tokenSupplier.setClientAccessToken(at);
             }
         }
         return tokenSupplier.getAuthorization(authPolicy, currentURI, message, fullHeader);

rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/CXFServlet.java

@@ -61,10 +61,8 @@ protected void loadBus(ServletConfig servletConfig) {
 
         String configLocation = servletConfig.getInitParameter("config-location");
         if (configLocation == null) {
-            try {
-                InputStream is = servletConfig.getServletContext().getResourceAsStream("/WEB-INF/cxf-servlet.xml");
+            try (InputStream is = servletConfig.getServletContext().getResourceAsStream("/WEB-INF/cxf-servlet.xml")) {
                 if (is != null && is.available() > 0) {
-                    is.close();
                     configLocation = "/WEB-INF/cxf-servlet.xml";
                 }
             } catch (Exception ex) {

rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.java

@@ -84,8 +84,10 @@ public void service(HttpServletRequest request,
         if ("HEAD".equals(request.getMethod())) {
             return;
         }
-        if (bus == null) {
-            bus = BusFactory.getDefaultBus(false);
+        synchronized (this) {
+            if (bus == null) {
+                bus = BusFactory.getDefaultBus(false);
+            }
         }
         final ServiceListWriter serviceListWriter;
         if ("false".equals(request.getParameter("formatted"))) {