prisma-risk / tsoracle / 26354468438

95%

push

github

fix(client): evict failed-dial ChannelPool entries to bound the cache (#290)

#286 moved the per-endpoint `OnceCell` insert ahead of the parse/dial so
concurrent first-callers share one cell, but a failed dial then left an
uninitialized cell in the `channels` map forever. Wire-supplied leader
hints (`LeaderHint.leader_endpoint`) reach `ChannelPool::client` as
arbitrary endpoint strings, so a contacted peer returning a fresh
unparseable hint per request could grow the map without bound — an
unbounded memory-retention vector reachable from a compromised cluster
peer.

`client` now evicts the endpoint's entry on the dial-error path. The cell
is provably uninitialized on `Err` (a `OnceCell` only stores a value on a
successful init, and `get_or_try_init` runs the closure at most once
across all sharers), and an `Arc::ptr_eq` identity check ensures we only
drop our own dead cell — never a fresh cell a concurrent caller may have
re-inserted and begun dialing. Retry semantics are unchanged: the next
caller re-inserts a fresh cell and re-dials. Single-flight on the success
path is intact.

Adds two in-crate regression tests (retention is only observable via the
private `channels` map): distinct failing endpoints leave nothing behind,
and a successful dial stays cached and initialized.

51 of 52 new or added lines in 1 file covered. (98.08%)

10724 of 11316 relevant lines covered (94.77%)

552690.73 hits per line