...
The other range of Singleton related subtleties involve object serialization and cloning. Serialization allows objects to be constructed without invoking the constructor and in turn allows object replication. It is also possible to create a copy of the Singleton object by cloning it using the object's clone method whenever the Singleton class implements Cloneable directly or through inheritance. Both these conditions violate the Singleton Design Pattern's guarantees.
Compliant Solution
It is recommended that Singleton classes be made non-serializable. As a precautionary measure, (serializable) classes must never save a reference to a singleton object in its instance variables. The getInstance method should be used instead, whenever access to the object is required.
| Wiki Markup |
|---|
To address the cloning issue, do not make the _Singleton_ class cloneable. If it indirectly implements the {{Cloneable}} interface through inheritance, override the object's {{clone}} method and throw a {{CloneNotSupportedException}} exception from within it. \[[Daconta 03|AA. Java References#Daconta 03]\] |
| Code Block | ||
|---|---|---|
| ||
class MySingleton {
private static MySingleton _instance;
private MySingleton() {
// construct object . .
// private constructor prevents instantiation by outside callers
}
// lazy initialization
public static synchronized MySingleton getInstance() {
if (_instance == null) {
_instance = new MySingleton();
}
return _instance;
}
public Object clone() throws CloneNotSupportedException {
throw new CloneNotSupportedException();
}
// Remainder of class definition . . .
}
|
See MSC05-J. Make sensitive classes noncloneable for more details about restricting the clone() method.
Noncompliant Code Example
When the utility of a class is over, it is free to be garbage collected. A dynamic reference can however, cause another instance of the Singleton class to be returned. This behavior can be troublesome when the program needs to maintain only one instance throughout its lifetime.
Compliant Solution
| Wiki Markup |
|---|
This compliant solution takes into account the garbage collection issue described above. A class is not garbage collected until the {{ClassLoader}} object used to load it itself becomes eligible for garbage collection. An easier scheme to prevent the garbage collection is to ensure that there is a direct or indirect reference to the singleton object to be preserved, from a live thread. This compliant solution demonstrates this method (adopted from \[[Patterns 02|AA. Java References#Patterns 02]\]). |
| Code Block | ||
|---|---|---|
| ||
public class ObjectPreserver implements Runnable {
private static ObjectPreserver lifeLine = new ObjectPreserver();
// Neither this class, nor HashSet will be garbage collected.
// References from HashSet to other objects will also exhibit this property
private static HashSet protectedSet = new HashSet();
private ObjectPreserver() {
new Thread(this).start(); // keeps the reference alive
}
public synchronized void run(){
try {
wait();
}
catch(InterruptedException e) { e.printStackTrace(); }
}
// Objects passed to this method will be preserved until
// the unpreserveObject method is called
public static void preserveObject(Object o) {
protectedSet.add(o);
}
// Unprotect the objects so that they can be garbage collected
public static void unpreserveObject(Object o) {
protectedSet.remove(o);
}
}
|
| Wiki Markup |
|---|
To be fully compliant, it must be ensured that the class obeys the _Singleton_ pattern's design contract. It is unreasonable to use the class for anything else, for example, as a method to share global state. \[[Daconta 03|AA. Java References#Daconta 03]\] |
Risk Assessment
Using lazy initialization in a Singleton without synchronizing the getInstance() method may lead to multiple instances and can thus violate the expected contract.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON33-J | low | unlikely | medium | P2 | L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[JLS 05|AA. Java References#JLS 05]\] [Chapter 17, Threads and Locks|http://java.sun.com/docs/books/jls/third_edition/html/memory.html]
\[[Fox 01|AA. Java References#Fox 01]\] [When is a Singleton not a Singleton?|http://java.sun.com/developer/technicalArticles/Programming/singletons/]
\[[Daconta 03|AA. Java References#Daconta 03]\] Item 15: Avoiding Singleton Pitfalls;
\[[Darwin 04|AA. Java References#Darwin 04]\] 9.10 Enforcing the Singleton Pattern
\[[Gamma 95|AA. Java References#Gamma 95]\] Singleton
\[[Patterns 02|AA. Java References#Patterns 02]\] Chapter 5, Creational Patterns, Singleton
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 543|http://cwe.mitre.org/data/definitions/543.html] "Use of Singleton Pattern in a Non-thread-safe Manner" |
CON32-J. Prefer notifyAll() to notify() 08. Concurrency (CON) CON34-J. Avoid deadlock by requesting fine-grained locks in the proper order