[maven-4.0.x] DefaultMaven: session scope leak on constructor exception

[elharo]

DefaultMaven: Session scope leak on constructor exception

Found in: maven-4.0.x branch
File: impl/maven-core/src/main/java/org/apache/maven/DefaultMaven.java (lines 213-216)
Severity: Medium

Description

sessionScope.enter() is called outside the try-finally block:

sessionScope.enter();
MavenChainedWorkspaceReader chainedWorkspaceReader =
        new MavenChainedWorkspaceReader(request.getWorkspaceReader(), ideWorkspaceReader);
try (CloseableSession closeableSession = ...) {
    ...
} finally {
    sessionScope.exit();
}

If the constructor new MavenChainedWorkspaceReader(...) at lines 214-215 throws any exception, the sessionScope.exit() in the finally block will never execute. This leaks the session scope's thread-local state. The ideWorkspaceReader parameter is @Nullable, and the constructor delegates to setReaders() which could throw.