...
A significant number of concurrency vulnerabilities arise from locking on the wrong kind of object. It is important to consider the properties of the lock object rather than simply scavenging for objects on which to synchronize.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
LCK01-J | medium | probable | medium | P8 | L2 |
Automated Detection
Some static analysis tools can detect violations of this rule.
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Lock Checker | Concurrency and lock errors (see Chapter 6) | ||||||
| CodeSonar |
| FB.MT_CORRECTNESS.DL_SYNCHRONIZATION_ON_BOOLEAN FB.MT_CORRECTNESS.DL_SYNCHRONIZATION_ON_BOXED_PRIMITIVE FB.MT_CORRECTNESS.DL_SYNCHRONIZATION_ON_SHARED_CONSTANT | Synchronization on Boolean Synchronization on boxed primitive Synchronization on interned String | ||||||
| Parasoft Jtest |
| TRS.SCS |
| Do not synchronize on constant Strings | ||||||||
| SonarQube |
| S1860 |
| ThreadSafe |
| CCE_CC_REUSEDOBJ_SYNC | Implemented |
Bibliography
...
...