| Wiki Markup |
|---|
Each thread in Java is assigned to a thread group upon the thread's creation. These groups are implemented by the {{java.lang.ThreadGroup}} class. If the thread group name is not specified explicitly, the |
...
{{main}} default group is assigned by the |
...
JVM |
...
\[[Tutorials |
...
2008|AA. Java References#Tutorials 08]\]. The convenience methods of the {{ThreadGroup}} class can be used to operate on all threads belonging to a thread group at once. For instance, the {{ThreadGroup.interrupt()}} method interrupts all threads in the thread group. Thread groups also help reinforce layered security by confining threads into groups so that they do not interfere with threads in other groups |
...
\[[JavaThreads |
...
2004|AA. Java References#JavaThreads 04]\]. |
...
| Wiki Markup |
|---|
Even though thread groups are useful for keeping threads organized, programmers seldom benefit from |
...
their use |
...
|
...
because many of the |
...
{{ThreadGroup}} class |
...
methods are deprecated (for example, {{allowThreadSuspension(), resume(), stop() and suspend()}} |
...
. Furthermore, many non-deprecated methods are obsolete in that they offer little desirable functionality. Ironically, a few {{ThreadGroup}} methods are not even thread-safe \[[Bloch |
...
2001|AA. Java References#Bloch 01]\]. |
...
Insecure
...
yet
...
non-deprecated
...
methods
...
include
| Wiki Markup |
|---|
*{{ThreadGroup.activeCount() |
...
}} |
...
According to the Java API, the {{activeCount()}} method |
...
\[[API |
...
2006|AA. Java References#API 06]\] |
...
|
Returns an estimate of the number of active threads in this thread group
| Wiki Markup |
|---|
This method is often used as a precursor to thread enumeration. If a thread is not started, it continues to reside in the thread group and is considered to be active. Furthermore, the active count is affected by the presence of certain system threads \[[API |
...
2006|AA. Java References#API 06]\]. Consequently, the _{{activeCount()}}_ method may not reflect the actual number of running tasks in the thread group. |
...
| Wiki Markup |
|---|
*{{ |
...
ThreadGroup.enumerate() |
...
}} |
...
According to the Java API, |
...
{{ThreadGroup}} class documentation \[[API |
...
2006|AA. Java References#API 06]\] |
...
Wiki Markup \[The {{enumerate()}} method\] Copies into the specified array every active thread in this thread group and its subgroups. An application should use the {{activeCount}} method to get an estimate of how big the array should be. If the array is too short to hold all the threads, the extra threads are silently ignored.
...
| Wiki Markup |
|---|
Using the {{ThreadGroup}} APIs to |
...
shut down threads also has pitfalls. Because the {{stop()}} method is deprecated, alternative ways are required to stop threads. According to The |
...
Java Programming Language \[[JPL |
...
2006|AA. Java References#JPL 06]\] |
...
One way is for the thread initiating the termination to join the other threads and so know when those threads have terminated. However, an application may have to maintain its own list of the threads it creates because simply inspecting the
ThreadGroupmay return library threads that do not terminate and for which join will not return.
| Wiki Markup |
|---|
The {{Executor}} framework provides a better API for managing a logical grouping of threads and offers secure facilities for handling shutdown and thread exceptions \[[Bloch |
...
2008|AA. Java References#Bloch 08]\]. |
Noncompliant Code Example
This noncompliant code example contains a NetworkHandler class that maintains a controller thread. This thread delegates a new request to a worker thread. To demonstrate the race condition in this example, the controller thread services three requests by starting three threads in succession from its run() method. All threads are defined to belong to the Chief thread group.
| Code Block | ||
|---|---|---|
| ||
h2. Noncompliant Code Example This noncompliant code example contains a {{NetworkHandler}} class that maintains a _controller_ thread {{controller}}. This thread delegates a new request to a worker thread. To demonstrate the race condition in this example, the {{controller}} thread services three requests by starting three threads in succession from its {{run()}} method. All threads are defined to belong to the {{Chief}} thread group. {code:bgColor=#FFcccc} final class HandleRequest implements Runnable { public void run() { // Do something } } public final class NetworkHandler implements Runnable { private static ThreadGroup tg = new ThreadGroup("Chief"); @Override public void run() { new Thread(tg, new HandleRequest(), "thread1").start(); // Start thread 1 new Thread(tg, new HandleRequest(), "thread2").start(); // Start thread 2 new Thread(tg, new HandleRequest(), "thread3").start(); // Start thread 3 } public static void printActiveCount(int point) { System.out.println("Active Threads in Thread Group " + tg.getName() + " at point(" + point + "):" + " " + tg.activeCount()); } public static void printEnumeratedThreads(Thread[] ta, int len) { System.out.println("Enumerating all threads..."); for(int i = 0; i < len; i++) { System.out.println("Thread " + i + " = " + ta[i].getName()); } } public static void main(String[] args) throws InterruptedException { // Start thread controller Thread thread = new Thread(tg, new NetworkHandler(), "controller"); // Start thread controller thread.start(); Thread[] ta = new Thread[tg.activeCount()]; // Gets the active count (insecure) printActiveCount(1); // At point 1P1 Thread.sleep(1000); // Delay to demonstrate TOCTOU condition (race window) printActiveCount(2); // At point 2, P2: the thread count changes as new threads are initiated int n = tg.enumerate(ta); // Incorrectly uses the (now stale) thread count obtained at point 1P1 int n = tg.enumerate(ta); printEnumeratedThreads(ta, n); // Silently ignores printing newly initiated threads // (between pointP1 1 and point 2P2) // This code destroys the thread group if it does not have any alive threads for (Thread thr : ta) { thr.interrupt(); while(thr.isAlive()); } tg.destroy(); } } {code} |
There
...
is
...
a
...
time-of-check-to-time-of-use (TOCTOU)
...
vulnerability
...
in
...
this
...
implementation
...
because
...
obtaining
...
the
...
count
...
and
...
enumerating
...
the
...
list
...
do
...
not
...
constitute
...
an
...
atomic
...
operation.
...
If
...
new
...
requests
...
occurs
...
after
...
the
...
call
...
to
...
activeCount()
...
and
...
before
...
the
...
call
...
to
...
enumerate()
...
in
...
the
...
main()
...
method,
...
the
...
total
...
number
...
of
...
threads
...
in
...
the
...
group
...
will
...
increase
...
but
...
the
...
enumerated
...
list
...
ta
...
will
...
contain
...
only
...
the
...
initial
...
number,
...
that
...
is
...
, two
...
thread
...
references
...
(
...
main
...
and
...
controller
...
).
...
Consequently,
...
the
...
program
...
will
...
fail
...
to
...
account
...
for
...
the
...
newly
...
started
...
threads
...
in
...
the
...
Chief thread
...
group
...
.
Any subsequent use of the ta array is insecure. For example, calling the destroy() method to destroy the thread group and its sub-groups will not work as expected. The precondition to calling destroy() is that the thread group is empty with no executing threads. The code attempts to accomplish this by interrupting every thread in the thread group. However, when the destroy() method is called, the thread group is not empty, which causes a java.lang.IllegalThreadStateException to be thrown.
Compliant Solution
This compliant solution uses a fixed thread pool, rather than a ThreadGroup, to group its three tasks. The java.util.concurrent.ExecutorService interface provides methods to manage the thread pool. Note that there are no methods for finding the number of actively executing threads or for enumerating through them. However, the logical grouping can help control the behavior of the group as a whole. For instance, all threads belonging to a particular thread pool can be terminated by calling the shutdownPool() method.
| Code Block | ||
|---|---|---|
| ||
public final class NetworkHandler {
private final ExecutorService executor;
NetworkHandler(int poolSize) {
this.executor = Executors.newFixedThreadPool(poolSize);
}
public void startThreads() {
for(int i = 0; i < 3; i++) {
executor.execute(new HandleRequest());
}
}
public void shutdownPool() {
executor.shutdown();
}
public static void main(String[] args) {
NetworkHandler nh = new NetworkHandler(3);
nh.startThreads();
nh.shutdownPool();
}
}
|
| Wiki Markup |
|---|
Before Java SE 5.0, the {{ThreadGroup}} class had to be extended because there was no other direct way to catch an uncaught exception in a separate thread. If the application had installed an {{UncaughtExceptionHandler}}, it could only be controlled by subclassing {{ThreadGroup}}. In recent versions,{{UncaughtExceptionHandler}} is maintained on a per-thread basis using an interface enclosed by the {{Thread}} class, which leaves little to no functionality for the {{ThreadGroup}} class \[[Goetz 2006|AA. Java References#Goetz 06]\], \[[Bloch 2008|AA. Java References#Bloch 08]\]. |
Refer to guideline TPS03-J. Ensure that tasks executing in a thread pool do not fail silently for more information on using uncaught exception handlers in thread pools.
Risk Assessment
Using the ThreadGroup APIs may result in race conditions, memory leaks, and inconsistent object state.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
THI01- J | low | probable | medium | P4 | L3 |
References
| Wiki Markup |
|---|
\[[API 2006|AA. Java References#API 06]\] Methods {{activeCount}} and {{enumerate}}, Classes ThreadGroup and Thread
\[[Bloch 01|AA. Java References#Bloch 01]\] Item 53: Avoid thread groups
\[[Bloch 2008|AA. Java References#Bloch 08]\] Item 73: Avoid thread groups
\[[Goetz 2006|AA. Java References#Goetz 06]\] Section 7.3.1, "Uncaught Exception Handlers"
\[[JavaThreads 04|AA. Java References#JavaThreads 04]\] 13.1 ThreadGroups
\[[JPL 2006|AA. Java References#JPL 06]\] 23.3.3. Shutdown Strategies
\[[SDN 2006|AA. Java References#SDN 06]\] Bug ID: 4089701 and 4229558
\[[Tutorials 2008|AA. Java References#Tutorials 08]\] |
...
THI00-J. Do not assume that the sleep(), yield() or getState() methods provide synchronization semantics 12. Locking (LCK)