| Wiki Markup |
|---|
It is critical to ensure that threads are activated correctly. Thread activation can be misleading because sometimes the code appears to be performing the function correctly, whereas it may be operating in the presence of subtle concurrency issues. |
...
It is usually a mistake to invoke the {{run()}} method on a {{Thread}} object. When invoked directly, the statements in the {{run()}} method execute, however, in the current thread instead of the newly created thread. Furthermore, if the {{Thread}} object is not constructed from a {{Runnable}} object but by instantiating a subclass of {{Thread}} that does not override the {{run()}} method, a call to the subclass's {{run()}} method invokes {{Thread.run()}} which does not perform any useful operations. |
...
It is recommended that if you have a Thread object that extends Runnable, and you wish to execute the object's run() method in the current thread, first cast the object to a Runnable and then invoke run().
Noncompliant Code Example
The run() method of interface Runnable must be invoked in its own thread, however, this noncompliant code example explicitly invokes it in the context of the current thread.
| Code Block | ||
|---|---|---|
| ||
{mc}
// Hidden text: What does this line mean?
It is recommended that if you have a {{Thread}} object that extends {{Runnable}}, and you wish to execute the object's {{run()}} method in the current thread, first cast the object to a {{Runnable}} and then invoke {{run()}}.
{mc}
h2. Noncompliant Code Example
The {{run()}} method of interface {{Runnable}} must be invoked in its own thread, however, this noncompliant code example explicitly invokes it in the context of the current thread.
{code:bgColor=#FFCCCC}
class Foo implements Runnable {
public void run() {
// ...
}
public static void main(String[] args) {
Foo f = new foo();
new Thread(f).run();
}
}
|
...
{code} The {{start()}} method is not invoked on the new thread because of the incorrect assumption that {{run()}} activates the thread. Consequently, the statements in the {{run()}} method execute, however, in the same thread instead of the new one. h2. |
...
Compliant Solution |
...
This compliant solution correctly uses the {{start()}} method to start a new thread which then executes the {{run()}} method. |
...
{code | ||
:bgColor | =#ccccff | } class Foo implements Runnable { public void run() { // ... } public static void main(String[] args) { Foo f = new foo(); new Thread(f).start(); } } {code} h2. Risk Assessment |
...
Failing to activate threads correctly can cause unexpected behavior. |
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON05- J | low | probable | medium | P4 | L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
...
|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level || | CON05- J | low | probable | medium | {color:green}{*}P4{*}{color} | {color:green}{*}L3{*}{color} | h3. Automated Detection TODO h3. Related Vulnerabilities Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+CON08-J]. h2. References \[[API 06|AA. Java References#API 06]\] Interface {{Runnable}} and class {{Thread}} |
...
---- [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|CON04-J. Synchronize using an internal private final lock |
...
object] [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|11. Concurrency (CON)] [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|VOID CON06-J. Do not defer a thread that is holding a lock] |