Repository: netty/netty
File: codec-http/src/test/java/io/netty/handler/codec/http/cors/CorsHandlerTest.java (Java)

Code before:
    public void simpleRequestDoNotAllowPrivateNetwork() {
        final CorsConfig config = forOrigin("http://localhost:8888").build();
        final EmbeddedChannel channel = new EmbeddedChannel(new CorsHandler(config));
        final FullHttpRequest request = optionsRequest("http://localhost:8888", "", null);
        request.headers().set(ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK, "true");
        assertFalse(channel.writeInbound(request));
        final HttpResponse response = channel.readOutbound();

        assertEquals("false", response.headers().get(ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK));
        assertTrue(ReferenceCountUtil.release(response));
    }

    @Test
    public void preflightEmptyLastDiscarded() {
        CorsConfig config = forOrigin("http://allowed").build();
        EmbeddedChannel ch = new EmbeddedChannel(new CorsHandler(config));

        FullHttpRequest preflight = new DefaultFullHttpRequest(HTTP_1_1, OPTIONS, "/test");
        preflight.headers().set(ORIGIN, "http://allowed");
        preflight.headers().set(ACCESS_CONTROL_REQUEST_METHOD, "GET");

        assertFalse(ch.writeInbound(preflight));

        Object outbound = ch.readOutbound();
        assertNotNull(outbound); // preflight response
        ReferenceCountUtil.release(outbound);

        LastHttpContent lastHttpContent = LastHttpContent.EMPTY_LAST_CONTENT;
        assertFalse(ch.writeInbound(lastHttpContent));
        ReferenceCountUtil.release(lastHttpContent); // safe release

        // Nothing should have been forwarded
        assertNull(ch.readInbound());

        assertFalse(ch.finish());
    }

    @Test
    public void preflightSecondEmptyLastForwardedAfterFirstDiscard() {
        CorsConfig config = forOrigin("http://allowed").build();
        EmbeddedChannel ch = new EmbeddedChannel(new CorsHandler(config));

        FullHttpRequest preflight = new DefaultFullHttpRequest(HTTP_1_1, OPTIONS, "/test");
        preflight.headers().set(ORIGIN, "http://allowed");
        preflight.headers().set(ACCESS_CONTROL_REQUEST_METHOD, "GET");

        assertFalse(ch.writeInbound(preflight));
        ReferenceCountUtil.release(ch.readOutbound());

        LastHttpContent first = LastHttpContent.EMPTY_LAST_CONTENT;
        LastHttpContent second = LastHttpContent.EMPTY_LAST_CONTENT;

Review comment (suggestion):
This should be removed... The handler is responsible to release.

```suggestion
```

Code after:
    public void simpleRequestDoNotAllowPrivateNetwork() {
        final CorsConfig config = forOrigin("http://localhost:8888").build();
        final EmbeddedChannel channel = new EmbeddedChannel(new CorsHandler(config));
        final FullHttpRequest request = optionsRequest("http://localhost:8888", "", null);
        request.headers().set(ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK, "true");
        assertFalse(channel.writeInbound(request));
        final HttpResponse response = channel.readOutbound();

        assertEquals("false", response.headers().get(ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK));
        assertTrue(ReferenceCountUtil.release(response));
    }

    @Test
    public void preflightEmptyLastDiscarded() {
        CorsConfig config = forOrigin("http://allowed").build();
        EmbeddedChannel ch = new EmbeddedChannel(new CorsHandler(config));

        FullHttpRequest preflight = new DefaultFullHttpRequest(HTTP_1_1, OPTIONS, "/test");
        preflight.headers().set(ORIGIN, "http://allowed");
        preflight.headers().set(ACCESS_CONTROL_REQUEST_METHOD, "GET");

        assertFalse(ch.writeInbound(preflight));

        Object outbound = ch.readOutbound();
        assertNotNull(outbound); // preflight response

        LastHttpContent lastHttpContent = LastHttpContent.EMPTY_LAST_CONTENT;
        assertFalse(ch.writeInbound(lastHttpContent));

        // Nothing should have been forwarded
        assertNull(ch.readInbound());

        assertFalse(ch.finish());
    }

    @Test
    public void preflightSecondEmptyLastForwardedAfterFirstDiscard() {
        CorsConfig config = forOrigin("http://allowed").build();
        EmbeddedChannel ch = new EmbeddedChannel(new CorsHandler(config));

        FullHttpRequest preflight = new DefaultFullHttpRequest(HTTP_1_1, OPTIONS, "/test");
        preflight.headers().set(ORIGIN, "http://allowed");
        preflight.headers().set(ACCESS_CONTROL_REQUEST_METHOD, "GET");

        assertFalse(ch.writeInbound(preflight));
        ReferenceCountUtil.release(ch.readOutbound());

        LastHttpContent first = LastHttpContent.EMPTY_LAST_CONTENT;
        LastHttpContent second = LastHttpContent.EMPTY_LAST_CONTENT;

        assertFalse(ch.writeInbound(first));