Bump httpcore/httpcore-nio to 4.4.16 and fix a connection-threading regression it introduces

modules/integration/src/test/java/org/apache/synapse/samples/framework/EchoHttpServerController.java

@@ -109,8 +109,13 @@ public void handle(HttpRequest request, HttpResponse response,
                         log.debug("Request entity read; size=" + entityContent.length);
                     }
                     response.setStatusCode(HttpStatus.SC_OK);
+                    // getValue() returns the full header, including any parameters, e.g.
+                    // "text/xml; charset=UTF-8". ContentType.create expects a bare MIME type:
+                    // up to httpcore 4.3.x it accepted the full value unchecked, but 4.4 rejects
+                    // any mime type containing '"', ',' or ';'. parse() is the method that
+                    // understands a complete header value, and it exists in both versions.
                     response.setEntity(new ByteArrayEntity(entityContent,
-                            ContentType.create(entity.getContentType().getValue())));
+                            ContentType.parse(entity.getContentType().getValue())));
                 } else {
                     response.setStatusCode(HttpStatus.SC_NO_CONTENT);
                 }

modules/transports/core/nhttp/src/main/java/org/apache/synapse/transport/utils/conn/SynapseNHttpClientConnection.java

@@ -28,6 +28,7 @@
 import org.apache.http.nio.NHttpClientEventHandler;
 import org.apache.http.nio.NHttpMessageParserFactory;
 import org.apache.http.nio.NHttpMessageWriterFactory;
+import org.apache.http.nio.reactor.EventMask;
 import org.apache.http.nio.reactor.IOSession;
 import org.apache.http.nio.util.ByteBufferAllocator;
 import org.apache.synapse.transport.passthru.TargetHandler;
@@ -89,6 +90,11 @@ public void consumeInput(final NHttpClientEventHandler handler) {
     @Override
     public void produceOutput(final NHttpClientEventHandler handler) {
         super.produceOutput(handler);
+        // httpcore 4.4 left write interest armed after a pipelined send, which the nhttp sender
+        // never does. Restore the 4.3.x clearing here; see SynapseNHttpServerConnection for why.
+        if (!this.outbuf.hasData() && this.contentEncoder == null && this.status != CLOSED) {
+            this.session.clearEvent(EventMask.WRITE);
+        }
     }
 
     /**

modules/transports/core/nhttp/src/main/java/org/apache/synapse/transport/utils/conn/SynapseNHttpServerConnection.java

@@ -0,0 +1,72 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+package org.apache.synapse.transport.utils.conn;
+
+import org.apache.http.HttpRequest;
+import org.apache.http.HttpResponse;
+import org.apache.http.config.MessageConstraints;
+import org.apache.http.entity.ContentLengthStrategy;
+import org.apache.http.impl.nio.DefaultNHttpServerConnection;
+import org.apache.http.nio.NHttpMessageParserFactory;
+import org.apache.http.nio.NHttpMessageWriterFactory;
+import org.apache.http.nio.NHttpServerEventHandler;
+import org.apache.http.nio.reactor.EventMask;
+import org.apache.http.nio.reactor.IOSession;
+import org.apache.http.nio.util.ByteBufferAllocator;
+
+import java.nio.charset.CharsetDecoder;
+import java.nio.charset.CharsetEncoder;
+
+/**
+ * Restores the {@link EventMask#WRITE} clearing that httpcore 4.4 dropped from
+ * {@code DefaultNHttpServerConnection.produceOutput} (kept armed for pipelining, which the
+ * nhttp listener does not use). Left armed, the dispatcher thread re-enters {@code produceOutput}
+ * even when idle and can race a worker thread's {@code commitResponse} on the same
+ * non-thread-safe session output buffer, corrupting its position/limit state.
+ * <p>
+ * Mirrors the client-side fix in {@link SynapseNHttpClientConnection}.
+ */
+public class SynapseNHttpServerConnection extends DefaultNHttpServerConnection {
+
+    public SynapseNHttpServerConnection(IOSession session,
+                                        int bufferSize,
+                                        int fragmentSizeHint,
+                                        ByteBufferAllocator allocator,
+                                        CharsetDecoder charDecoder,
+                                        CharsetEncoder charEncoder,
+                                        MessageConstraints constraints,
+                                        ContentLengthStrategy incomingContentStrategy,
+                                        ContentLengthStrategy outgoingContentStrategy,
+                                        NHttpMessageParserFactory<HttpRequest> requestParserFactory,
+                                        NHttpMessageWriterFactory<HttpResponse> responseWriterFactory) {
+        super(session, bufferSize, fragmentSizeHint, allocator,
+                charDecoder, charEncoder, constraints, incomingContentStrategy,
+                outgoingContentStrategy, requestParserFactory, responseWriterFactory);
+    }
+
+    @Override
+    public void produceOutput(final NHttpServerEventHandler handler) {
+        super.produceOutput(handler);
+        if (!this.outbuf.hasData() && this.contentEncoder == null && this.status != CLOSED) {
+            this.session.clearEvent(EventMask.WRITE);
+        }
+    }
+
+}

modules/transports/core/nhttp/src/main/java/org/apache/synapse/transport/utils/conn/SynapseNHttpServerConnectionFactory.java

@@ -95,7 +95,7 @@ public DefaultNHttpServerConnection createConnection(IOSession session) {
                     responseWriterFactory,
                     sourceConnLog);
         } else {
-            return new DefaultNHttpServerConnection(
+            return new SynapseNHttpServerConnection(
                     session,
                     config.getBufferSize(),
                     config.getFragmentSizeHint(),

modules/transports/core/nhttp/src/main/java/org/apache/synapse/transport/utils/conn/logging/LoggingNHttpServerConnection.java

@@ -25,12 +25,12 @@
 import org.apache.http.HttpResponse;
 import org.apache.http.config.MessageConstraints;
 import org.apache.http.entity.ContentLengthStrategy;
-import org.apache.http.impl.nio.DefaultNHttpServerConnection;
 import org.apache.http.nio.NHttpMessageParserFactory;
 import org.apache.http.nio.NHttpMessageWriterFactory;
 import org.apache.http.nio.NHttpServerEventHandler;
 import org.apache.http.nio.reactor.IOSession;
 import org.apache.http.nio.util.ByteBufferAllocator;
+import org.apache.synapse.transport.utils.conn.SynapseNHttpServerConnection;
 
 import java.io.IOException;
 import java.nio.charset.CharsetDecoder;
@@ -41,7 +41,7 @@
  * additional logging features. This implementation enhances the default connection
  * class by logging all the major events that occur on the connection instance.
  */
-public class LoggingNHttpServerConnection extends DefaultNHttpServerConnection {
+public class LoggingNHttpServerConnection extends SynapseNHttpServerConnection {
 
     private final Log log;
 

pom.xml

@@ -1254,7 +1254,7 @@
         <truezip.version>6.6</truezip.version>
         <jsch.version>0.1.31</jsch.version>
         <jms-1.1-spec.version>1.1</jms-1.1-spec.version>
-        <httpcore.nio.version>4.3.3</httpcore.nio.version>
+        <httpcore.nio.version>4.4.16</httpcore.nio.version>
         <http.client.version>4.3.6</http.client.version>
         <aspectj.version>1.9.9.1</aspectj.version>
         <qfj.version>1.6.2</qfj.version>