According to the Java Language Specification \[[JLS 05|AA. Java References#JLS 05]\], section, 8.3.1.4 {{volatile}} Fields:
{quote}
A field may be declared {{volatile}}, in which case the Java memory model (§17) ensures that all threads see a consistent value for the variable.
{quote}
Notably, this applies only to primitive fields and immutable member objects. The visibility guarantee does not extend to mutable objects that are not thread-safe, even if their references are declared {{volatile}}. A thread may not observe a recent write from another thread to a member field of such an object. Declaring an object {{volatile}} to ensure visibility of the most up-to-date object state does not work without the use of synchronization, unless the object is [immutable|BB. Definitions#immutable].
In the absence of synchronization, the effect of declaring a field {{volatile}} is that when one thread sets the field to a new value, other threads can instantly see the new object reference. If the referenced object is immutable, other threads always see a consistent view of the state of the object. However, ifits state does not work without the use of synchronization, unless the object is [immutable|BB. Definitions#immutable]. If the object is mutable and not thread-safe, other threads may see a partially-constructed object, or an object in a (temporarily) inconsistent state \[[Goetz 07|AA. Java References#Goetz 07]\]. Declaring the object {{volatile}} does not prevent this issue.
Technically, the object does not have to be strictly immutable to be used safely. If it can be proved that the member objects is thread-safe by design, the field that will hold its reference may be declared as {{volatile}}. However, this approach to using volatile burdens maintainability and should be avoided as far as possible.
h2. Noncompliant Code Example (Arrays)
This noncompliant code example shows an array object (arrays are objects in Java) that is declared {{volatile}}.
{code:bgColor=#FFcccc}
final class Foo {
volatile private int[] arr = new int[20];
public int getFirst() {
return arr[0];
}
public void setFirst(int n) {
arr[0] = n;
}
// ...
}
{code}
It appears that when a value is written by a thread to one of the array elements, it becomes instantly visible to other threads. This is misleading because the {{volatile}} keyword just makes the array reference visible to all threads and does not affect the actual data contained within the array. For example, when a thread assigns a new value to {{arr\[1\]}} another thread that is attempting to read the value of {{arr\[1\]}}, may observe ana inconsistentstale value.
This happens because there is no [happens-before|BB. Definitions#happens-before order] relation between the thread that calls {{setFirst()}} and the thread that calls {{getFirst()}}. NormallyA a happens-before relation exists between a thread that writes to a volatile variable and a thread that subsequently reads it. But this code is neither writing to nor reading from a volatile variable. The array's 'volatility' applies only to the array reference, not to the array elements.
h2. Compliant Solution ({{AtomicIntegerArray}})
This compliant solution uses the {{java.util.concurrent.atomic.AtomicIntegerArray}} concurrency utility. Its {{set(index, value)}} method ensures that the write is atomic and the resulting value is made visible to other threads. The other threads can retrieve a value from a specific index by using the {{get(index)}} method.
{code:bgColor=#ccccff}
final class Foo {
private final AtomicIntegerArray aiaatomicArray = new AtomicIntegerArray(5);
public int getFirst() {
return aiaatomicArray.get(0);
}
public void setFirst(int n) {
aiaatomicArray.set(0, 10);
}
// ...
}
{code}
In this compliant solution, the {{AtomicIntegerArray}} guarantees a happens-before relation between a thread that calls {{aiaatomicArray.set()}} and a thread that subsequently calls {{aiaatomicArray.get()}}. However, if a thread calls {{getFirst()}} first, it sees the default value of the atomic integer (0).
h2. Compliant Solution (synchronization)
To ensure visibility, accessor methods may synchronize access while performing operations on non-volatile elements of an array whichthat is declared {{volatile}}. Note that the array reference need not be volatile for the code to be thread-safe.
{code:bgColor=#ccccff}
final class Foo {
private int[] arr = new int[20];
public synchronized int getFirst() {
return arr[1];
}
public synchronized void setFirst(int n) {
arr[1] = n;
}
}
{code}
Synchronization establishes a happens-before relation between the thread that calls {{setFirst()}} and the thread that subsequently calls {{getFirst()}}. Consequently, the array's element set by {{setFirst()}} is guaranteed to be visible to {{getFirst()}}.
h2. Noncompliant Code Example (Mutable object)
This noncompliant code example declares an instance field of type {{Properties}} as {{volatile}}. The referencedinstance of object {{Properties}} can be mutated using the {{put()}} method. This makes objects of class {{Foo}} mutable.
{code:bgColor=#FFcccc}
final class Foo {
private volatile Properties properties;
public Foo() {
properties = new Properties();
// Load some useful values into properties
}
public String get(String s) {
return properties.getProperty(s);
}
public void put(String key, String value) {
// Perform validation of value before inserting
properties.setProperty(key, value);
}
}
{code}
If one thread calls {{get()}} while another calls {{put()}}, the first thread may receive a stale, or an internally inconsistent value from the {{Properties}} object because the operations within {{put()}} modify the state of the {{Properties}} object instance. Declaring the object {{volatile}} does not prevent this data race.
h2. Compliant Solution (immutable)
This compliant solution renders the {{Foo}} class immutable. Consequently, once it is properly constructed, no thread can modify the state of the {{Properties}} object instance and cause a data race.
{code:bgColor=#ccccff}
final class Foo {
private final Properties properties;
public Foo() {
properties = new Properties();
// Load some useful values into properties
}
public String get(String s) {
return properties.getProperty(s);
}
}
{code}
The {{Foo}} class is [immutable|BB. Definitions#immutable] because all its fields are {{final}} and the {{properties}} field is being safely published. The shortcoming of making {{Foo}} immutable is that the {{put()}} method can no longer be accommodated.
h2. Noncompliant Code Example (cheap read-write lock)
This noncompliant code example attempts to use the cheap read-write lock trick \[[Goetz 07|AA. Java References#Goetz 07]\]. The {{properties}} field is declared as {{volatile}} to synchronize reads and writes of the field. The non-atomic {{put()}} method is also synchronized as well to ensure that its statements are executed atomically.
{code:bgColor=#ffcccc}
final class Foo {
private volatile Properties properties;
public Foo() {
properties = new Properties();
// Load some useful values into properties
}
public String get(String s) {
return properties.getProperty(s);
}
public synchronized void put(String key, String value) {
// Perform validation of value
properties.setProperty(key, value);
}
}
{code}
The cheap read-write lock trick is often used with primitive types that require non-atomic operations (such as, increment) to be performed on them preserves atomicity of compound operations such as increment using synchronization, at the same time, providing faster access times for atomic field accesses. However, the trick does not work with mutable objects, because the visibility of {{volatile}} does not extend to their members. Consequently, if one thread adds a property using {{put}}, other itthreads may not beobserve visible to other threadsthis change. There is no [happens-before relation|BB. Definitions#happens-before order] between the write and a subsequent read of the property.
The cheap read-write lock trick is also discussed in [CON01-J. Ensure that compound operations on shared variables are atomic].
h2. Compliant Solution (synchronized)
This compliant solution uses method synchronization to ensure thread safety.
{code:bgColor=#ccccff}
final class Foo {
private final Properties properties;
public Foo() {
properties = new Properties();
// Load some useful values into properties
}
public synchronized String get(String s) {
return properties.getProperty(s);
}
public synchronized void put(String key, String value) {
// Perform validation of value
properties.setProperty(key, value);
}
}
{code}
Note that the {{properties}} field is not declared {{volatile}} because this solution achieves thread-safety by using syncronizationsynchronization. The field is declared {{final}} so that its reference is not published when it is in a partially initialized state (see [CON26-J. Do not publish partially initialized objects]).
h2. Noncompliant Code Example (mutable sub-object)
This noncompliant code example declares the field {{FORMAT}} as {{volatile}}. However, the field stores a reference to a mutable object, {{DateFormat}}.
{code:bgColor=#FFcccc}
final class DateHandler {
private static volatile DateFormat FORMAT =
DateFormat.getDateInstance(DateFormat.MEDIUM);
public static Date parse(String str) throws ParseException {
return FORMAT.parse(str);
}
}
{code}
In the presence of multiple threads, this results in subtle thread safety issues because {{DateFormat}} is not thread-safe \[[API 06|AA. Java References#API 06]\]. For instance, a thread may observe correctly formatted output for aan completelyarbitrary different date when it invokes {{parse()}} with a known date.
{mc}
// Calls DateHandler, demo code
public class DateCaller implements Runnable {
public void run(){
try {
System.out.println(DateHandler.parse("Jan 1, 2010"));
} catch (ParseException e) {
}
public static void main(String[] args) {
for(int i=0;i<10;i++)
new Thread(new DateCaller()).start();
}
}
{mc}
h2. Compliant Solution (instance per call/defensive copying)
This compliant solution creates and returns a new {{DateFormat}} instance for every invocation of the {{parse()}} method. \[[API 06|AA. Java References#API 06]\]
{code:bgColor=#ccccff}
final class DateHandler {
public static Date parse(String str) throws ParseException {
DateFormat format = DateFormat.getDateInstance(DateFormat.MEDIUM);
return format.parse(str);
}
}
{code}
This does not violate [OBJ11-J. Defensively copy private mutable class members before returning their references] because the class no longer contains internal mutable state, but only a local field, {{format}}.
h2. Compliant Solution (synchronization)
This compliant solution synchronizes statements within the {{parse()}} method and consequently, the class {{DateHandler}} is thread-safe \[[API 06|AA. Java References#API 06]\]. There is no requirement forof declaring the {{FORMAT}} field as {{volatile}}.
{code:bgColor=#ccccff}
final class DateHandler {
private static DateFormat FORMAT =
DateFormat.getDateInstance(DateFormat.MEDIUM);
public static Date parse(String str) throws ParseException {
synchronized (FORMAT) {
return FORMAT.parse(str);
}
}
}
{code}
h2. Compliant Solution ({{ThreadLocal}} storage)
This compliant solution uses a {{ThreadLocal}} object to store one {{DateFormat}} instance per thread.
{code:bgColor=#ccccff}
final class DateHandler {
private static final ThreadLocal<DateFormat> df = new ThreadLocal<DateFormat>() {
protected DateFormat initialValue() {
return DateFormat.getDateInstance(DateFormat.MEDIUM);
}
};
// ...
}
{code}
h2. Risk Assessment
Assuming that declaring a field {{volatile}} guarantees visibility of the members of the referenced object may cause threads to observe stale values of the members.
|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| CON11-J | medium | probable | medium | {color:#cc9900}{*}P8{*}{color} | {color:#cc9900}{*}L2{*}{color} |
h3. Automated Detection
TODO
h3. Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+CON11-J].
h2. References
\[[Goetz 07|AA. Java References#Goetz 07]\] Pattern #2: "one-time safe publication"
\[[Miller 09|AA. Java References#Miller 09]\] Mutable Statics
\[[API 06|AA. Java References#API 06]\] Class {{java.text.DateFormat}}
\[[JLS 05|AA. Java References#JLS 05]\]
----
[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|FIO36-J. Do not create multiple buffered wrappers on an InputStream] [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|09. Input Output (FIO)] [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|09. Input Output (FIO)]
|
