Skip to content

Conversation

philwebb
Copy link
Member

@philwebb philwebb commented Apr 9, 2025

Update SpringFactoriesLoader so that the cache stores only the factories and not the complete loader.

Prior to this commit, if a cache entry was added with the thread conect classloader, the loader instance would a added and the classloader stored. If the thread context classloader subsequently changes, and a call is made to forDefaultResourceLocation with null for the classloader, the cached entry would be used which contains the older classloader.

Update `SpringFactoriesLoader` so that the cache stores only the
factories and not the complete loader.

Prior to this commit, if a cache entry was added with the thread
conect classloader, the loader instance would a added and the
classloader stored. If the thread context classloader subsequently
changes, and a call is made to `forDefaultResourceLocation` with
`null` for the classloader, the cached entry would be used which
contains the older classloader.

Fixes spring-projectsgh-34732
@philwebb philwebb force-pushed the factories-loader-cache-pollution branch from f7af69c to 6f59e55 Compare April 9, 2025 21:47
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Apr 9, 2025
philwebb added a commit to spring-projects/spring-boot that referenced this pull request Apr 9, 2025
Update `SpringApplication` to work around `SpringFactoriesLoader`
cache pollution by loading factories using a `null` class loader.

See spring-projects/spring-framework#34732
for details.
@bclozel bclozel added the in: core Issues in core modules (aop, beans, core, context, expression) label Jun 3, 2025
@sdeleuze sdeleuze self-assigned this Jun 30, 2025
@sdeleuze sdeleuze added type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged or decided on labels Jun 30, 2025
@sdeleuze sdeleuze added this to the 6.2.9 milestone Jun 30, 2025
@sdeleuze
Copy link
Contributor

Sorry for the delay @philwebb, I think we missed that one, I will work on merging it into 6.2.x.

sdeleuze pushed a commit to sdeleuze/spring-framework that referenced this pull request Jul 1, 2025
Update `SpringFactoriesLoader` so that the cache stores only the
factories and not the complete loader.

Prior to this commit, if a cache entry was added with the thread
conect classloader, the loader instance would a added and the
classloader stored. If the thread context classloader subsequently
changes, and a call is made to `forDefaultResourceLocation` with
`null` for the classloader, the cached entry would be used which
contains the older classloader.

Closes spring-projectsgh-34732
@sdeleuze sdeleuze closed this in 89b8b1a Jul 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: core Issues in core modules (aop, beans, core, context, expression) type: bug A general bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants