...
Code Block | ||
---|---|---|
| ||
public class SomeObject { // Locks on the object's monitor public synchronized void changeValue() { // ... } public static SomeObject lookup(String name) { // ... } } // Untrusted code String name = // ... SomeObject someObject = SomeObject.lookup(name); if (someObject == null) { // ... handle error } synchronized (someObject) { while (true) { // Indefinitely delaylock someObject Thread.sleep(Integer.MAX_VALUE); } } |
...
Exposing the lock object to untrusted code can result in DoS.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
LCK00-J | low | probable | medium | P4 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
The Checker Framework |
| Lock Checker | Concurrency and lock errors (see Chapter 6) | ||||||
CodeSonar |
| JAVA.CONCURRENCY.LOCK.ISTR | Synchronization on Interned String (Java) | ||||||
Parasoft Jtest |
| CERT.LCK00.SOPF | Do not synchronize on "public" fields since doing so may cause deadlocks | ||||||
SonarQube |
|
|
| S2445 |
Related Guidelines
Bibliography
Item 52. Document Thread Safety |
...