Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: added normative text; some sentences were activated

Wiki Markup
DoPrograms notmay submit only tasks that do not support interruption using {{Thread.interrupt()}} to a thread poolpools ifthat itrequire isthe necessaryability to shut down the thread pool or to cancel individual tasks within itthe pool. Submitting tasks that lack interruption support to such thread pools is forbidden. According to the Java API interface \[[API 2006|AA. Bibliography#API 06]\], the {{java.util.concurrent.ExecutorService.shutdownNow()}} method

...

Code Block
bgColor#FFcccc
public final class SocketReader implements Runnable { // Thread-safe class
  private final Socket socket;
  private final BufferedReader in;
  private final Object lock = new Object();

  public SocketReader(String host, int port) throws IOException {
    this.socket = new Socket(host, port);
    this.in = new BufferedReader(new InputStreamReader(this.socket.getInputStream()));
  }

  // Only one thread can use the socket at a particular time
  @Override public void run() {
    try {
      synchronized (lock) {
        readData();
      }
    } catch (IOException ie) {
      // Forward to handler
    }
  }

  public void readData() throws IOException {
    String string;
    try {
      while ((string = in.readLine()) != null) {
        // Blocks until end of stream (null)
      }
    } finally {
      shutdown();
    }
  }

  public void shutdown() throws IOException {
    socket.close();
  }
}

public final class PoolService {
  private final ExecutorService pool;

  public PoolService(int poolSize) {
    pool = Executors.newFixedThreadPool(poolSize);
  }

  public void doSomething() throws InterruptedException, IOException {
    pool.submit(new SocketReader("somehost", 8080));
    // ...
    List<Runnable> awaitingTasks = pool.shutdownNow();
  }

  public static void main(String[] args) throws InterruptedException, IOException {
    PoolService service = new PoolService(5);
    service.doSomething();
  }
}

Because The shutdownNow() method may fail to shut down the thread pool because the task does not lacks support for interruption using the Thread.interrupt() method, there is no guarantee that the shutdownNow() method will shut down the thread pool. Using . Use of the shutdown() method does not also fails to fix the problem either because it waits until all executing tasks have finished.

...

TPS02-EX1: Short-running tasks that execute without blocking are not required to adhere to exempt from this rule.

Risk Assessment

Submitting tasks that are not interruptible may preclude the uninterruptible may prevent a thread pool from shutting down and consequently may cause denial of service.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

TPS02-J

low

probable

medium

P4

L3

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="095f49bb00318997-0af737d1-45084047-b4dea1eb-8c10a1f88651d912161ad961"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

interface ExecutorService

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4aff384dd3df17a1-4cead9ec-47504e60-8eed895b-fe6b1f17cd1cf6e1e7cb604b"><ac:plain-text-body><![CDATA[

[[Goetz 2006

AA. Bibliography#Goetz 06]]

Chapter 7: Cancellation and shutdown

]]></ac:plain-text-body></ac:structured-macro>

...