TireSwingSoftware/openassign-server — Issue #112: Memory leak in authorizer method cache
Author: jc0n
Created: 2012-02-25 00:14:23+00:00
State: open
Labels: behavior, security

There is a problem with the way the method result caching is being done in the authorizer. The cache key is in most cases the session id of the auth token which of course expires after some time. The cache growth is unbounded and entries are never expired so over time and usage this cache will continue to consume memory.

https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/authorizer.py#L364

https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/authorizer.py#L394

https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/authorizer.py#L404

This is something that by nature is unlikely to catch in the test suite because the cache is frequently flushed and there is a relatively small number of unique auth tokens.