...
| Code Block | ||
|---|---|---|
| ||
class MySingleton {
private static MySingleton _instance;
private MySingleton() {
// construct object . . .
// private constructor prevents instantiation by outside callers
}
// lazy initialization
// error, no synchronization on method access
public static MySingleton getInstance() {
if (_instance == null) {
_instance = new MySingleton();
}
return _instance;
}
// Remainder of class definition . . .
}
|
Noncompliant Code Example
...
| Code Block | ||
|---|---|---|
| ||
class MySingleton {
private static MySingleton _instance;
private MySingleton() {
// construct object . . .
// private constructor prevents instantiation by outside callers
}
// lazy initialization
public static synchronized MySingleton getInstance() {
if (_instance == null) {
_instance = new MySingleton();
}
return _instance;
}
// Remainder of class definition . . .
}
|
Applying a static modifier to the getInstance() method which returns the Singleton allows the method to be accessed subsequently (after the initial call) without creating a new object.
...
| Code Block | ||
|---|---|---|
| ||
class MySingleton {
private static MySingleton _instance;
private MySingleton() {
// construct object
// private constructor prevents instantiation by outside callers
}
// lazy initialization
public static synchronized MySingleton getInstance() {
if (_instance == null) {
_instance = new MySingleton();
}
return _instance;
}
public Object clone() throws CloneNotSupportedException {
throw new CloneNotSupportedException();
}
// Remainder of class definition
}
|
See MSC05-J. Make sensitive classes noncloneable for more details about restricting the clone() method.
Noncompliant Code Example
When the utility of a class is over, it is free to be garbage collected. A dynamic reference can however, cause another instance of the Singleton class to be returned. This behavior can be troublesome when the program needs to maintain only one instance throughout its lifetime.
Compliant Solution
| Wiki Markup |
|---|
This compliant solution takes into account the garbage collection issue described above. A class is not garbage collected until the {{ClassLoader}} object used to load it itself becomes eligible for garbage collection. An easier scheme to prevent the garbage collection is to ensure that there is a direct or indirect reference to the singleton object to be preserved, from a live thread. This compliant solution demonstrates this method (adopted from \[[Patterns 02|AA. Java References#Patterns 02]\]). |
| Code Block | ||
|---|---|---|
| ||
public class ObjectPreserver implements Runnable { private static ObjectPreserver lifeLine = new ObjectPreserver(); // Neither this class, nor HashSet will be garbage collected. // References from HashSet to other objects will also exhibit this property private static HashSet protectedSet = new HashSet(); private ObjectPreserver() { new Thread(this).start(); // keeps the reference alive } public synchronized void run(){ try { wait(); } catch(InterruptedException e) { e.printStackTrace(); } } // Objects passed to this method will be preserved until // the unpreserveObject method is called public static void preserveObject(Object o) { protectedSet.add(o); } // Unprotect the objects so that they can be garbage collected public static void unpreserveObject(Object o) { protectedSet.remove(o); } } |
| Wiki Markup |
|---|
To be fully compliant, it must be ensured that the class obeys the _Singleton_ pattern's design contract. It is unreasonable to use the class for anything else, for example, as a method to share global state. \[[Daconta 03|AA. Java References#Daconta 03]\] |
Risk Assessment
Using lazy initialization in a Singleton without synchronizing the getInstance() method may lead to multiple instances and can thus violate the expected contract.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON33-J | low | unlikely | medium | P2 | L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[JLS 05|AA. Java References#JLS 05]\] [Chapter 17, Threads and Locks|http://java.sun.com/docs/books/jls/third_edition/html/memory.html]
\[[Fox 01|AA. Java References#Fox 01]\] [When is a Singleton not a Singleton?|http://java.sun.com/developer/technicalArticles/Programming/singletons/]
\[[Daconta 03|AA. Java References#Daconta 03]\] Item 15: Avoiding Singleton Pitfalls;
\[[Darwin 04|AA. Java References#Darwin 04]\] 9.10 Enforcing the Singleton Pattern
\[[Gamma 95|AA. Java References#Gamma 95]\] Singleton
\[[Patterns 02|AA. Java References#Patterns 02]\] Chapter 5, Creational Patterns, Singleton
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 543|http://cwe.mitre.org/data/definitions/543.html] "Use of Singleton Pattern in a Non-thread-safe Manner" |
...
CON32-J. Prefer notifyAll() to notify() 08. Concurrency (CON) CON34-J. Avoid deadlock by requesting fine-grained locks in the proper order