Page History

public final class ValidationService {
  // ...
  public StringBuilder fieldAggregator(String... inputs)
    throws InterruptedException, ExecutionException {
    // ...
    for (int i = 0; i < inputs.length; i++) {
      // Don't pass-in thread pool  
      results[i] = pool.submit(new ValidateInput<String>(inputs[i])); 
    }
    // ...
  }
}

// Does not use same thread pool
public final class ValidateInput<V> implements Callable<V> { 
  private final V input;

  ValidateInput(V input) {
    this.input = input;
  }

  @Override public V call() throws Exception {
    // ...
    for (int i = 0; i < inputs.length; i++) {
      results[i] = pool.submit(new ValidateInput<String>(inputs[i])); // Don't pass-in thread pool
    } If validation fails, throw an exception here
    return (V) new SanitizeInput().sanitize(input);
  }
}

public final class SanitizeInput<V> {  // No longer a Callable task
  public SanitizeInput() {}

  public V sanitize(V input) {
    // ...
Sanitize  }
}

public final class ValidateInput<V> implements Callable<V> { // Does not use same thread pool
  private final V input;

  ValidateInput(V input) {
    this.input = inputinput and return
    return input;
  }

  @Override public V call() throws Exception {
    // If validation fails, throw an exception here
    return (V) new SanitizeInput().sanitize(input);
  }
}

public final class SanitizeInput<V> {  // No longer a Callable task
  public SanitizeInput() {}

  public V sanitize(V input) {
    // Sanitize input and return
    return input;
  }
}
{code}

Thread starvation issues can be mitigated by choosing a large thread pool size, however, adding too many threads can cause a system to becomes unresponsive, resulting in a denial of service (see [TPS00-J. Use thread pools to enable graceful degradation of service during traffic bursts|TPS00-J. Use thread pools to enable graceful degradation of service during traffic bursts]).

Note that operations that have further constraints, such as the total number of database connections or total {{ResultSet}} objects open at a particular time, impose an upper bound on the thread pool size as each thread continues to block until the resource becomes available.

Private static {{ThreadLocal}} variables may be used to maintain local state in each thread. When using thread pools, the lifetime of {{ThreadLocal}} variables should be bounded by the corresponding task \[[Goetz 06|AA. Java References#Goetz 06]\]. Furthermore, these variables should not be used to communicate between tasks. There are also additional constraints in the use of {{ThreadLocal}} variables in thread pools (see [CON33-J. Ensure ThreadLocal variables are reinitialized when using thread pools|TPS04-J. Ensure ThreadLocal variables are reinitialized when using thread pools]).



{mc}
h2. Compliant Solution (Unbounded Thread Pool)

This compliant solution uses a cached thread pool, which dynamically creates new threads as needed and prevents deadlock. However, this implementation may result in resource exhaustion and should not be used in front-end or critical production systems.

{code:bgColor=#ccccff}
public final class ValidationService {
  private final ExecutorService pool;

  public ValidationService(int poolSize) {
    pool = Executors.newCachedThreadPool();
  }
  // ...
}
{code}

According to the Java API \[[API 06|AA. Java References#API 06]\], the {{Executors.newCachedThreadPool()}} method:

{quote}
Creates a thread pool that creates new threads as needed, but will reuse previously constructed threads when they are available. These pools will typically improve the performance of programs that execute many short-lived asynchronous tasks. Calls to execute will reuse previously constructed threads if available. If no existing thread is available, a new thread will be created and added to the pool. Threads that have not been used for sixty seconds are terminated and removed from the cache. Thus, a pool that remains idle for long enough will not consume any resources.
{quote}
{mc}

h2. Noncompliant Code Example (Sub-tasks)

This noncompliant code example contains a series of sub-tasks that each execute in a shared thread pool  \[[Gafter 06|AA. Java References#Gafter 06]\].  The {{BrowserManager}} class calls {{perUser()}} which starts tasks which invoke {{perProfile}} which start tasks which invoke {{perTab()}} which starts tasks that invoke {{doSomething()}}.  The {{BrowserManager}} then waits for the tasks to finish. The threads are allowed to invoke {{doSomething}

public final class BrowserManager {
  private final ExecutorService pool = Executors.newFixedThreadPool(10);
  private final int numberOfTimes;
  private static AtomicInteger count = new AtomicInteger(); // count = 0

  public BrowserManager(int n) {
    numberOfTimes = n;
  }

  public void perUser() {
    methodInvoker(numberOfTimes, "perProfile");
    pool.shutdown();
  }

  public void perProfile() {
    methodInvoker(numberOfTimes, "perTab");
  }

  public void perTab() {
    methodInvoker(numberOfTimes, "doSomething");
  }

  public void doSomething() {
    System.out.println(count.getAndIncrement());
  }

  public void methodInvoker(int n, final String method) {
    final BrowserManager manager = this;
    Callable<Object> callable = new Callable<Object>() {
      @Override public Object call() throws Exception {
        Method meth = manager.getClass().getMethod(method);
        return meth.invoke(manager);
      }
    };

    Collection<Callable<Object>> collection = Collections.nCopies(n, callable);
    try {
      Collection<Future<Object>> futures = pool.invokeAll(collection);
    } catch (InterruptedException e) {
      // Forward to handler
      Thread.currentThread().interrupt(); // Reset interrupted status
    }
    // ...
  }

  public static void main(String[] args) {
    BrowserManager manager = new BrowserManager(5);
    manager.perUser();
  }
}

()}} in any order provided that {{count}} correctly records the number of methods executed.

{code:bgColor=#FFCCCC}
public final class BrowserManager {
  private final static ExecutorServiceThreadPoolExecutor pool = Executors.newFixedThreadPool(10
    new ThreadPoolExecutor(0, 10, 60L, TimeUnit.SECONDS,
                           new SynchronousQueue<Runnable>());
  private final int numberOfTimes;
  private static AtomicInteger count = new AtomicInteger(); // count = 0

  public BrowserManager(int n) {static {
    pool.setRejectedExecutionHandler(
    numberOfTimes = nnew ThreadPoolExecutor.CallerRunsPolicy());
  }

  public void perUser() {
    methodInvoker(numberOfTimes, "perProfile");
    pool.shutdown();
  }

  public void perProfile() {
    methodInvoker(numberOfTimes, "perTab");
  }

  public void perTab() {
    methodInvoker(numberOfTimes, "doSomething");
  }

  public void doSomething() {
    System.out.println(count.getAndIncrement());
  }

  public void methodInvoker(int n, final String method) {
    final BrowserManager manager = this;
    Callable<Object> callable = new Callable<Object>() {
      @Override public Object call() throws Exception {
        Method meth = manager.getClass().getMethod(method);
        return meth.invoke(manager);
      }
    };

    Collection<Callable<Object>> collection = Collections.nCopies(n, callable);
    try {
      Collection<Future<Object>> futures = pool.invokeAll(collection);
    } catch (InterruptedException e) {
      // Forward to handler
      Thread.currentThread().interrupt(); // Reset interrupted status
    }
    // ...
  }

  public static void main(String[] args) {
    BrowserManager manager = new BrowserManager(5);
    manager.perUser();
  }
}
{code}

Unfortunately, this program is susceptible to a thread starvation deadlock. For example, if each of the five {{perUser}} threads spawns five {{perProfile}} threads which each spawn a {{perTab}} thread, the thread pool will be exhausted and it will not be possible for {{perTab()}} to allocate any additional threads to invoke the {{doSomething()}} method.

h2. Compliant Solution ({{CallerRunsPolicy}})

{mc}To prevent thread starvation, every level (worker) must have a double ended queue where all sub-tasks are queued \[[Goetz 06|AA. Java References#Goetz 06]\]. Each level removes the most recently generated sub-task from the queue so that it can process it. When there are no more threads left to process, the current level runs the least-recently created sub-task of another level by picking and removing it from that level's queue (work stealing). {mc}

This compliant solution selects and schedules tasks for execution; avoiding thread starvation deadlock. It sets the {{CallerRunsPolicy}} on a {{ThreadPoolExecutor}}, and uses a {{SynchronousQueue}} \[[Gafter 06|AA. Java References#Gafter 06]\]. The policy dictates that if the thread pool runs out of available threads, any subsequent tasks will run in the thread that submitted the tasks.

{code:bgColor=#ccccff}
public final class BrowserManager {
  private final static ThreadPoolExecutor pool =
    new ThreadPoolExecutor(0, 10, 60L, TimeUnit.SECONDS,
                           new SynchronousQueue<Runnable>());
  private final int numberOfTimes;
  private static AtomicInteger count = new AtomicInteger(); // count = 0

  static {
    pool.setRejectedExecutionHandler(
    new ThreadPoolExecutor.CallerRunsPolicy());
  }

  // ...
}
{code}

According to Goetz et al. \[[Goetz 06|AA. Java References#Goetz 06]\]:

{quote}
A {{SynchronousQueue}} is not really a queue at all, but a mechanism for managing handoffs between threads. In order to put an element on the {{SynchronousQueue}}, another thread must already be waiting to accept the handoff. It no thread is waiting but the current pool size is less than the maximum, {{ThreadPoolExecutor}} creates a new thread; otherwise the task is rejected according to the saturation policy.
{quote}
According to the Java API \[[API 06|AA. Java References#API 06]\], the {{CallerRunsPolicy}} class is:

{quote}
A handler for rejected tasks that runs the rejected task directly in the calling thread of the {{execute}} method, unless the executor has been shut down, in which case the task is discarded.
{quote}

In this compliant solution, tasks that have other tasks waiting to accept the hand-off are added to the {{SynchronousQueue}} when the thread pool is full. For example, tasks corresponding to {{perTab()}} are added to the {{SynchronousQueue}} because the tasks corresponding to {{perProfile()}} are waiting to receive the hand-off. Once the pool is full, additional tasks are rejected according to the saturation policy in effect.  Because the {{CallerRunsPolicy}} is used to handle these rejected tasks, all the rejected tasks are executed in the main thread that started the initial tasks. When all the threads corresponding to {{perTab()}} have finished executing, the next set of tasks corresponding to {{perProfile()}} are added to the {{SynchronousQueue}} because the hand-off is subsequently used by {{perUser()}} tasks . Consequently, all tasks are executed in bottom-up fashion.

The caller-runs policy allows graceful degradation of service when faced with many requests by distributing the workload from the thread pool to the work queue. Because the submitted tasks do not block for any reason other than waiting for other tasks to complete, the caller-runs policy guarantees that the current thread can handle multiple tasks sequentially. The caller-runs policy would not prevent thread-starvation deadlock if the tasks were to block for some other reason, such as network IO. Furthermore, because {{SynchronousQueue}} does not store tasks indefinitely for future execution, there is no unbounded queue growth, and all tasks are handled by the current thread, or by a thread in the thread pool.

This compliant solution is subject to the vagaries of the thread scheduler which may not optimally schedule the tasks, however, it avoids thread starvation deadlock.


h2. Risk Assessment

Executing interdependent tasks in a thread pool can lead to denial of service.

|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| CON30\- J | low | probable | medium | {color:green}{*}P4{*}{color} | {color:green}{*}L3{*}{color} |

h3. Automated Detection

TODO

h3. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+FIO38-J].

h2. References

\[[API 06|AA. Java References#API 06]\]
\[[Gafter 06|AA. Java References#Gafter 06]\] [A Thread Pool Puzzler|http://gafter.blogspot.com/2006/11/thread-pool-puzzler.html]
\[[Goetz 06|AA. Java References#Goetz 06]\] 8.3.2 "Managing queued tasks", 8.3.3 "Saturation Policies", 5.3.3 Deques and work stealing

----
[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|TPS00-J. Use thread pools to enable graceful degradation of service during traffic bursts]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|12. Locking (LCK)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|TPS02-J. Ensure that tasks submitted to a thread pool are interruptible]// ...
}