...
| Wiki Markup |
|---|
Threads are removed from the thread array either when they are stopped or when their {{run}} method has concluded. As a result, if a thread is not started, it continues to reside in the array despite the loss of the original reference. \[[JavaThreads 99|AA. Java References#JavaThreads 99]\] |
Noncompliant Code Example
This noncompliant code example shows a NetworkHandler class that maintains a controller thread. This thread is responsible for spawning a new thread every time a new network connection request is received. For the sake of brevity, it is assumed that the controller thread invokes two methods (method1() and method2()) in succession and waits for a few milliseconds. The method1() method creates and starts two threads that are equivalent to two consequent connection requests, and so does the method2() method. All threads are defined to belong to the same group, Chief.
...
| Code Block | ||
|---|---|---|
| ||
class NetworkHandler implements Runnable {
private static ThreadGroup tg = new ThreadGroup("Chief");
public void run() {
try {
method1();
method2();
Thread.sleep(500);
} catch(InterruptedException e) {
// Forward to handler
}
}
public static void method1() throws InterruptedException {
Thread t1 = new Thread(tg, new HandleRequest(), "t1");
Thread t2 = new Thread(tg, new HandleRequest(), "t2");
t1.start();
t2.start();
}
public static void method2() {
Thread t3 = new Thread(tg, new HandleRequest(), "t3");
Thread t4 = new Thread(tg, new HandleRequest(), "t4");
t3.start();
t4.start();
}
public static void main(String[] args) throws InterruptedException {
Thread t = new Thread(tg, new NetworkHandler(), "t");
t.start();
System.out.println("Active Threads in Thread Group at point (1):" +
t.getThreadGroup().getName() + " " + Thread.activeCount());
Thread ta[] = new Thread[Thread.activeCount()];
for(int i = 0; i < 500000; i++) { } // Delay to demonstrate TOCTOU condition
System.out.println("Active Threads in Thread Group at point (2):" +
t.getThreadGroup().getName() + " " + Thread.activeCount());
int n = Thread.enumerate(ta);
System.out.println("Enumerating...");
for(int i = 0; i < n; i++) {
System.out.println("Thread " + i + " = " + ta[i].getName());
}
}
}
class HandleRequest implements Runnable {
public void run() {
System.out.println("Active Threads in Thread Group (Handler thread invoked this): " +
Thread.currentThread().getThreadGroup().getName() + " " + Thread.activeCount());
}
}
|
Compliant Solution
| Wiki Markup |
|---|
To be compliant, avoid using the {{ThreadGroup}} class. Before Java 5.0, this class had to be extended as there was no other way to control the {{UncaughtExceptionHandler}}. The application provided handler {{UncaughtExceptionHandler}} comes into the picture when a thread exits because of an uncaught exception. In recent versions, the {{UncaughtExceptionHandler}} is maintained on a per-thread basis using an interface enclosed by the {{Thread}} class, leaving little to no functionality for the {{ThreadGroup}} class. \[[Goetz 06|AA. Java References#Goetz 06]\] |
Risk Assessment
Using the ThreadGroup APIs may result in race conditions, memory leaks and inconsistent object state.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON01- J | low | probable | low | P6 | L2 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] Methods {{activeCount}} and {{enumerate}}, Classes ThreadGroup and Thread
\[[JavaThreads 04|AA. Java References#JavaThreads 04]\] 13.1 ThreadGroups
\[[Bloch 01|AA. Java References#Bloch 01]\] Item 53: Avoid thread groups
\[[Goetz 06|AA. Java References#Goetz 06]\] 7.3.1. Uncaught Exception Handlers
\[[SDN 06|AA. Java References#SDN 06]\] Bug ID: 4089701 and 4229558 |
...