...
According to the Java API class java.lang.String documentation [API 2006]:
When the
intern()method is invoked, if the pool already contains a string equal to thisStringobject as determined by theequals(Object)method, then the string from the pool is returned. Otherwise, thisStringobject is added to the pool and a reference to thisStringobject is returned.
...
A significant number of concurrency vulnerabilities arise from locking on the wrong kind of object. It is important to consider the properties of the lock object rather than simply scavenging for objects on which to synchronize.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
LCK01-J | medium | probable | medium | P8 | L2 |
Automated Detection
Some static analysis tools can detect violations of this rule.
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Lock Checker | Concurrency and lock errors (see Chapter 6) | ||||||
| Parasoft Jtest |
| CERT.LCK01.SCS | Do not synchronize on constant Strings | ||||||
| PVS-Studio |
| V6070 | |||||||
| SonarQube |
| S1860 | |||||||
| ThreadSafe |
| CCE_CC_REUSEDOBJ_SYNC | Implemented |
Bibliography
...
