...
Misuse
...
of
...
synchronization
...
primitives
...
is
...
a
...
common
...
source
...
of
...
concurrency
...
issues. Synchronizing on objects that may be reused can result in deadlock and non-deterministic behavior.
Noncompliant Code Example (Boolean lock object)
This noncompliant code example synchronizes on a Boolean lock object.
| Code Block | ||
|---|---|---|
| ||
A significant number of concurrency vulnerabilities arise from locking on the wrong kind of object. -An analysis of the JDK 1.6.0 source code discovered 31 bugs that fell into this category \[[Pugh 08|AA. Java References#Pugh 08]\]- {mc} probably incorrect after splitting{mc}. It is important to recognize the entities with whom synchronization is required rather than indiscreetly scavenging for objects to synchronize on. {color:red}we need a more precise statement about what specifically this guideline requires{color} {mc} any suggestions? {mc} {mc} not yet {mc} h2. Noncompliant Code Example ({{Boolean}} lock object) This noncompliant code example synchronizes on a {{Boolean}} lock object. {code:bgColor=#FFcccc} private final Boolean initialized = Boolean.FALSE; public void doSomething() { synchronized(initialized) { // ... } } {code} The {{Boolean}} type is unsuitable for locking purposes because it allows only two values: {{TRUE}} and {{FALSE}}. Boolean literals containing the same value share unique instances of class {{Boolean}} in the JVM. In this example, {{initialized}} references the instance corresponding to the value {{FALSE}}. If any other code inadvertently synchronizes on a {{Boolean}} literal with the value {{FALSE}}, the lock instance is reused and the system may become unresponsiveness or deadlock. h2. Noncompliant Code Example (boxed primitive) This noncompliant code example locks on a boxed {{Integer}} object. {code:bgColor=#FFcccc} |
The Boolean type is unsuitable for locking purposes because it allows only two values: TRUE and FALSE. Boolean literals containing the same value share unique instances of class Boolean in the JVM. In this example, initialized references the instance corresponding to the value FALSE. If any other code inadvertently synchronizes on a Boolean literal with the value FALSE, the lock instance is reused and the system may become unresponsiveness or deadlock.
Noncompliant Code Example (boxed primitive)
This noncompliant code example locks on a boxed Integer object.
| Code Block | ||
|---|---|---|
| ||
int lock = 0;
private final Integer Lock = lock; // Boxed primitive Lock is shared
public void doSomething() {
synchronized(Lock) {
// ...
}
}
{code}
|
Boxed
...
types
...
may
...
use
...
the
...
same
...
instance
...
for
...
a
...
range
...
of
...
integer
...
values
...
and
...
consequently
...
suffer
...
from
...
the
...
same
...
problem
...
as
...
Boolean
...
constants.
...
If
...
the
...
value
...
of
...
the
...
primitive
...
can
...
be
...
represented
...
as
...
a
...
byte,
...
the
...
wrapper
...
object
...
is
...
reused.
...
Note
...
that
...
the
...
use
...
of
...
the
...
boxed
...
Integer
...
wrapper
...
object
...
is
...
insecure;
...
instances
...
of
...
the
...
Integer
...
object
...
constructed
...
using
...
the
...
new
...
operator
...
(
...
new
...
Integer(value)
...
)
...
are
...
unique
...
and
...
not
...
reused.
...
In
...
general,
...
holding
...
a
...
lock
...
on
...
any
...
data
...
type
...
that
...
contains
...
a
...
boxed
...
value
...
is
...
insecure.
...
Compliant Solution (Integer)
...
This
...
compliant
...
solution
...
recommends
...
locking
...
on
...
a
...
non-boxed
...
Integer.
...
The
...
doSomething()
...
method
...
synchronizes
...
using
...
the
...
intrinsic
...
lock
...
of
...
the
...
Integer
...
instance,
...
Lock
...
.
| Code Block | ||||
|---|---|---|---|---|
| =
| |||
} int lock = 0; private final Integer Lock = new Integer(lock); public void doSomething() { synchronized(Lock) { // ... } } {code} |
When
...
explicitly
...
constructed,
...
an
...
Integer
...
object
...
has
...
a
...
unique
...
reference
...
and
...
its
...
own
...
intrinsic
...
lock
...
that
...
is
...
not
...
shared
...
with
...
other
...
Integer
...
objects
...
or
...
boxed
...
integers
...
having
...
the
...
same
...
value.
...
While
...
this
...
is
...
an
...
acceptable
...
solution,
...
it
...
may
...
cause
...
maintenance
...
problems
...
because
...
developers
...
might
...
incorrectly
...
assume
...
that
...
boxed
...
integers
...
are
...
appropriate
...
lock
...
objects.
...
A
...
more
...
appropriate
...
solution
...
is
...
to
...
synchronize
...
on
...
an
...
internal
...
private
...
final
...
lock
...
Object
...
as
...
described
...
in
...
the
...
following
...
compliant
...
solution.
Noncompliant Code Example (interned String object)
This noncompliant code example locks on an interned String object.
| Code Block | ||
|---|---|---|
| ||
h2. Noncompliant Code Example (interned {{String}} object) This noncompliant code example locks on an interned {{String}} object. {code:bgColor=#FFcccc} private final String _lock = new String("LOCK").intern(); public void doSomething() { synchronized(_lock) { // ... } } {code} |
| Wiki Markup |
|---|
According to the Java API \[[API 06|AA. Java References#API 06]\], class {{java.lang.String}} documentation: |
...
When the
intern()
...
method
...
is
...
invoked,
...
if
...
the
...
pool
...
already
...
contains
...
a
...
string
...
equal
...
to
...
this
...
String
...
object
...
as
...
determined
...
by
...
the
...
equals(Object)
...
method,
...
then
...
the
...
string
...
from
...
the
...
pool
...
is
...
returned.
...
Otherwise,
...
this
...
String
...
object
...
is
...
added
...
to
...
the
...
pool
...
and
...
a
...
reference
...
to
...
this
...
String
...
object
...
is
...
returned.
...
Consequently,
...
an
...
interned
...
String
...
object
...
behaves
...
like
...
a
...
global
...
variable
...
in
...
the
...
Java
...
Virtual
...
Machine
...
(JVM).
...
As
...
demonstrated
...
in
...
this
...
noncompliant
...
code
...
example,
...
even
...
if
...
every
...
instance
...
of
...
an
...
object
...
maintains
...
its
...
own
...
field
...
lock
...
,
...
the
...
field
...
references
...
a
...
common
...
String
...
constant.
...
Locking
...
on
...
String
...
constants
...
has
...
the
...
same
...
problem
...
as
...
locking
...
Boolean
...
constants.
...
Additionally,
...
hostile
...
code
...
from
...
any
...
other
...
package
...
can
...
exploit
...
this
...
vulnerability
...
if
...
the
...
class
...
is
...
accessible
...
(see
...
...
...
...
...
...
...
...
...
...
).
...
Noncompliant
...
Code
...
Example
...
(
...
String
...
literal)
...
This
...
noncompliant
...
code
...
example
...
locks
...
on
...
a
...
final
...
String
...
literal.
| Code Block | ||||
|---|---|---|---|---|
| =
| |||
} // This bug was found in jetty-6.1.3 BoundedThreadPool private final String _lock = "LOCK"; // ... synchronized(_lock) { // ... } // ... {code} A {{String}} literal is a constant and is interned. Consequently, it suffers from the same pitfalls as the preceding noncompliant code example. h2. Compliant |
A String literal is a constant and is interned. Consequently, it suffers from the same pitfalls as the preceding noncompliant code example.
Compliant Solution (String instance)
This compliant solution locks on a String instance that is not interned.
| Code Block | ||
|---|---|---|
| ||
Solution ({{String}} instance)
This compliant solution locks on a {{String}} instance that is not interned.
{code:bgColor=#ccccff}
private final String _lock = new String("LOCK");
public void doSomething() {
synchronized(_lock) {
// ...
}
}
|
A String instance differs from a String literal. The instance has a unique reference and its own intrinsic lock that is not shared by other string object instances or literals. A better approach is to synchronize on an internal private final lock object as shown in the following compliant solution.
Compliant Solution (internal private final lock Object)
This compliant solution synchronizes on an internal private final lock object. This is one of the few cases where a java.lang.Object instance is useful.
| Code Block | ||
|---|---|---|
| ||
{code} A {{String}} instance differs from a {{String}} literal. The instance has a unique reference and its own intrinsic lock that is not shared by other string object instances or literals. A better approach is to synchronize on an internal private final lock object as shown in the following compliant solution. h2. Compliant Solution (internal private final lock {{Object}}) This compliant solution synchronizes on an internal private final lock object. This is one of the few cases where a {{java.lang.Object}} instance is useful. {code:bgColor=#ccccff} private final Object lock = new Object(); public void doSomething() { synchronized(lock) { // ... } } {code} For more information on using an {{Object}} as a lock, see [ |
For more information on using an Object as a lock, see CON04-J.
...
...
...
...
...
...
...
...
...
.
...
Risk
...
Assessment
A significant number of concurrency vulnerabilities arise from locking on the wrong kind of object. It is important to consider the properties of the the lock object rather than indiscreetly scavenging for objects to synchronize on.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON02- J | medium | probable | medium | P8 | L2 |
Automated Detection
The following table summarizes the examples flagged as violations by FindBugs:
Noncompliant Code Example | Flagged | Checker | Message |
|---|---|---|---|
| Yes | DL_SYNCHRONIZATION_ON_BOOLEAN |
...
Synchronization |
...
on |
...
Boolean |
...
could |
...
deadlock |
...
Boxed |
...
primitive |
...
Yes |
...
DL_SYNCHRONIZATION_ON_BOXED_PRIMITIVE |
...
Synchronization |
...
on |
...
Integer |
...
could |
...
deadlock |
...
interned | No | n/a |
...
n/a |
...
String |
...
literal |
...
Yes |
...
DL_SYNCHRONIZATION_ON_SHARED_CONSTANT |
...
Synchronization |
...
on |
...
interned |
...
String |
...
could |
...
deadlock |
...
The
...
following
...
table
...
summarizes
...
the
...
examples
...
flagged
...
as
...
violations
...
by
...
...
...
:
Noncompliant Code Example | Flagged | Message |
|---|---|---|
| No | No obvious issues |
Boxed primitive | No | No obvious issues |
interned | No | No obvious issues |
String literal | No | No data available about field accesses |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] Class String, Collections
\[[Findbugs 08|AA. Java References#Findbugs 08]\].
\[[Pugh 08|AA. Java References#Pugh 08]\] "Synchronization"
\[[Miller 09|AA. Java References#Miller 09]\] Locking
\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Wrapper Implementations|http://java.sun.com/docs/books/tutorial/collections/implementations/wrapper.html] |
...
...
...
...
...
...
...
...
variables 11. Concurrency (CON) CON03-J.
...
...
...
...
...
...
...
...
...