Build up of ConstraintMappings when stopping and starting WebAppContext

[lachlan-roberts]

Jetty version
10.0.x

Description
After calling stop() then start() a bunch of times on a WebAppContext, I get a build up of constraint mappings.
Here is a section of a dump I took showing the ConstraintMappings, I improved the toString of ConstraintMapping in my local code to get extra info on the mappings.

+= org.eclipse.jetty.server.session.SessionHandler1764291958==dftMaxIdleSec=1800 - STARTED
|  += ConstraintSecurityHandler@45c8d09f{STARTED} - STARTED
...
|  |  +> constraints size=1
|  |     +> java.util.concurrent.CopyOnWriteArrayList@c2a36b28(size=12)
|  |        +: ConstraintMapping25e2a451{pathSpec=/, constraint=SC{Disable TRACE,[],DC_UNSET}}
|  |        +: ConstraintMapping53812a9b{pathSpec=/, constraint=SC{Enable everything but TRACE,-,DC_UNSET}}
|  |        +: ConstraintMapping4c3937b5{pathSpec=/, constraint=SC{Disable TRACE,[],DC_UNSET}}
|  |        +: ConstraintMapping36d93000{pathSpec=/, constraint=SC{Enable everything but TRACE,-,DC_UNSET}}
|  |        +: ConstraintMapping1f56b6bd{pathSpec=/, constraint=SC{Disable TRACE,[],DC_UNSET}}
|  |        +: ConstraintMapping8a52f2d{pathSpec=/, constraint=SC{Enable everything but TRACE,-,DC_UNSET}}
|  |        +: ConstraintMapping53b63709{pathSpec=/, constraint=SC{Disable TRACE,[],DC_UNSET}}
|  |        +: ConstraintMapping576c0759{pathSpec=/, constraint=SC{Enable everything but TRACE,-,DC_UNSET}}
|  |        +: ConstraintMapping12fbc963{pathSpec=/, constraint=SC{Disable TRACE,[],DC_UNSET}}
|  |        +: ConstraintMapping3c589122{pathSpec=/, constraint=SC{Enable everything but TRACE,-,DC_UNSET}}
|  |        +: ConstraintMapping431830b3{pathSpec=/, constraint=SC{Disable TRACE,[],DC_UNSET}}
|  |        +: ConstraintMapping74f9b146{pathSpec=/, constraint=SC{Enable everything but TRACE,-,DC_UNSET}}

[janbartel]

@lachlan-roberts did you specify a ConstraintSecurityHandler in a context xml or code equivalent, or did you let jetty create it for you on startup?

[janbartel]

This is applicable for jetty-9.4 as well.

ConstraintMappings are never cleared out of the ConstraintSecurityHandler, thus if they were added via a web.xml/web-fragment.xml, annotation or javax.servlet api call, they will be duplicated when the context restarts.

Note that this generally isn't a problem when running in the distro, as the deployer removes the WebAppContext and creates a fresh one when it restarts the webapp. Embedded code or the jetty-maven-plugin would be affected though.

The problem seems to have been there since 2012 with the following commit: 1d89bef

[janbartel]

Opened PR #5842

[janbartel]

Fixed by PR #5842