Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migration of unmigrated content due to installation of a new plugin

...

Each thread in Java is assigned to a thread group upon the thread's creation. These groups are implemented by the java.lang.ThreadGroup class. When the thread group name is not specified explicitly, the main default group is assigned by the Java Virtual Machine (JVM) [Java Tutorials]. The convenience methods of the ThreadGroup class can be used to operate on all threads belonging to a thread group at once. For instance, the ThreadGroup.interrupt() method interrupts all threads in the thread group. Thread groups also help reinforce layered security by confining threads into groups so that they avoid interference with threads in other groups [JavaThreads 2004].

Even though thread groups are useful for keeping threads organized, programmers seldom benefit from their use because many of the methods of the ThreadGroup class (for example, allowThreadSuspension(), resume(), stop(), and suspend()) are deprecated. Furthermore, many nondeprecated methods are obsolete in that they offer little desirable functionality. Ironically, a few ThreadGroup methods are not even thread-safe [Bloch 2001].

Insecure yet nondeprecated methods include

  • ThreadGroup.activeCount()
    According to the Java API [API 2014], the activeCount() method

    returns an estimate of the number of active threads in the current thread's thread group and its subgroups.

    This method is often used as a precursor to thread enumeration. Threads that have never started nevertheless reside in the thread group and are considered to be active. The active count is also affected by the presence of certain system threads [API 2014]. Consequently, the activeCount() method might fail to reflect the actual number of running tasks in the thread group.
  • ThreadGroup.enumerate()
    According to the Java API [API 2014], ThreadGroup class documentation

    [The enumerate() method] copies into the specified array every active thread in this thread group and its subgroups....
    An application might use the activeCount method to get an estimate of how big the array should be; however, if the array is too short to hold all the threads, the extra threads are silently ignored.

Using the ThreadGroup APIs to shut down threads also has pitfalls. Because the stop() method is deprecated, programs require alternative methods to stop threads. According to The Java Programming Language [JPL 2006]:

One way is for the thread initiating the termination to join the other threads and so know when those threads have terminated. However, an application may have to maintain its own list of the threads it creates because simply inspecting the ThreadGroup may return library threads that do not terminate and for which join will not return.

The Executor framework provides a better API for managing a logical grouping of threads and offers secure facilities for handling shutdown and thread exceptions [Bloch 2008]. Consequently, programs must not invoke ThreadGroup methods.

Noncompliant Code Example

This noncompliant code example contains a NetworkHandler class that maintains a controller thread. The controller thread delegates each new request to a worker thread. To demonstrate the race condition in this example, the controller thread serves three requests by starting three threads in succession from its run() method. All threads are defined to belong to the Chief thread group.

Code Block
bgColor#FFcccc
final class HandleRequest implements Runnable {
  public void run() {
    // Do something
  }
}

public final }}. A group is assigned to a thread upon its creation. If the group name is not specified explicitly, the default group called {{main}} is assigned by the Java Virtual Machine (JVM). The convenience methods of the {{ThreadGroup}} class can be used to operate on all threads at once, such as, by using the {{interrupt()}} method. Another use is to reinforce layered security by confining threads into groups so that they do not interfere with each other. \[[JavaThreads 04|AA. Java References#JavaThreads 04]\]

While there may be a few benefits, the associated dangers demand deeper insight into the real utility of the {{ThreadGroup}} class. Several of the {{ThreadGroup}} APIs ({{allowThreadSuspension, resume, stop, suspend}}) have been deprecated and the remainder are seldom used because they offer little desirable functionality. Ironically, a few APIs are not even thread-safe. \[[Bloch 01|AA. Java References#Bloch 01]\]

A programmer may sometimes wish to enumerate all the threads in a group as a precursor to other operations. This is accomplished by using the {{activeCount()}} method that "Returns an estimate of the number of active threads in this thread group. " \[[API 06|AA. Java References#API 06]\]. Notice that there is no absolute word on whether it returns the exact count or not; the definition of _active_ also has a different connotation here. A thread that is constructed and not started is still counted by the {{activeCount()}} method as _active_. 

According to the Java API \[[API 06|AA. Java References#API 06]\], class {{ThreadGroup}} documentation:

{quote}
\[The {{enumerate}} method\] Copies into the specified array every active thread in this thread group and its subgroups. An application should use the {{activeCount}} method to get an estimate of how big the array should be. If the array is too short to hold all the threads, the extra threads are silently ignored. 
{quote}

Threads are removed from the thread array either when they are stopped or when their {{run()}} method has finished executing. As a result, if a thread is not started, it continues to reside in the array despite the loss of the original reference. \[[JavaThreads 99|AA. Java References#JavaThreads 99]\]

Using the {{ThreadGroup}} APIs to facilitate thread shutdown also has pitfalls. "One way is for the thread initiating the termination to join the other threads and so know when those threads have terminated. However, an application may have to maintain its own list of the threads it creates because simply inspecting the {{ThreadGroup}} may return library threads that do not terminate and for which join will not return." \[[JPL 06|AA. Java References#JPL 06]\].

h2. Noncompliant Code Example

This noncompliant code example shows a {{NetworkHandler}} class that maintains a _controller_ thread. This thread is responsible for spawning a new thread every time a new network connection request is received. For the sake of brevity, it is assumed that the _controller_ thread invokes two methods ({{method1()}} and {{method2()}}) in succession and waits for a few milliseconds. The {{method1()}} method creates and starts two threads that are equivalent to two consequent connection requests, and so does the {{method2()}} method. All threads are defined to belong to the same group, {{Chief}}.

{mc} The other surprise is that after enumerating array ta, Chief also consists of a thread called "main" {mc}

{code:bgColor=#FFcccc}
class NetworkHandler implements Runnable {
  private static ThreadGroup tg = new ThreadGroup("Chief");

  @Override public void run() {
    try {
      method1();
      method2();
      Thread.sleep(2000);
    } catch(InterruptedException e) {
      // Forward to handler
    }
  }

  public static void method1() throws InterruptedException {
    new Thread(tg, new HandleRequest(), "t1thread1").start(); // Start t1
    new Thread(tg, new HandleRequest(), "t2thread2").start(); // Start t2	
  }

  public static void method2() {			  
    new Thread(tg, new HandleRequest(), "t3").start(); // Start t3
    new Thread(tg, new HandleRequest(), "t4"thread3").start(); // Start t4		
  }
	
  public static void printThreadsprintActiveCount(Thread t, int point) {
    System.out.println("Active Threads in Thread Group " + t.getThreadGroup()tg.getName() +
 
       " at point(" + point + "):" + " " + ttg.activeCount());
  }

  public static void printEnumeratedThreads(Thread[] ta[], int len) {
    System.out.println("Enumerating all threads...");
    for (int i = 0; i < len; i++) {
      System.out.println("Thread " + i + " = " + ta[i].getName());
    }   
  }

  public static void main(String[] args) throws InterruptedException {
    // Start thread controller
    Thread tthread = new Thread(tg, new NetworkHandler(), "tcontroller");
    tthread.start();

	    // Gets the active count (insecure)
    Thread[] ta[] = new Thread[ttg.activeCount()];		

    printThreadsprintActiveCount(t, 1);  // At point 1 P1
    Thread.sleep(1000);  // Delay to demonstrate TOCTOU condition (race window)
    Thread.sleep(1000);
    // CountP2: changesthe becausethread ofcount initiationchanges ofas new threads between points 1 and 2are initiated
    printThreadsprintActiveCount(t, 2);  
    // AtIncorrectly uses pointthe 2, the(now stale) thread count changesobtained at P1
    int n = ttg.enumerate(ta); // Incorrectly
 uses the (now stale)// threadSilently countignores obtainednewly atinitiated pointthreads 1	
    printEnumeratedThreads(ta, n); //
 Silently ignores printing newly initiated threads
  }
}

class HandleRequest implements Runnable {
  public void run() {
    System.out.println("Active Threads in Thread Group " +   
     // Thread.currentThread().getThreadGroup().getName() + 
  (between P1 and P2)

    // This code destroys the thread group if it does 
    // not have any live threads
    "for (HandlerThread threadthr invoked: thista): {
 " + " " + Threadthr.activeCountinterrupt());	

      while(true) {} // Infinite loop to keep threads active for demonstration	thr.isAlive());
    }
    tg.destroy();
  }
}
{code}

There is a Time of Check-Time of Use 

This implementation contains a time-of-check, time-of-use (TOCTOU)

...

vulnerability

...

because it obtains the count and enumerates the list without ensuring atomicity. If one or more new requests were to occur after the call to activeCount() and before the call to enumerate() in the main() method, the total number of threads in the group would increase, but the enumerated list ta would contain only the initial number, that is, two thread references: main and controller. Consequently, the program would fail to account for the newly started threads in the Chief thread group.

Any subsequent use of the ta array would be insecure. For example, calling the destroy() method to destroy the thread group and its subgroups would not work as expected. The precondition to calling destroy() is that the thread group must be empty with no executing threads. The code attempts to comply with the precondition by interrupting every thread in the thread group. However, the thread group would not be empty when the destroy() method was called, causing a java.lang.IllegalThreadStateException to be thrown.

Compliant Solution

This compliant solution uses a fixed thread pool rather than a ThreadGroup to group its three tasks. The java.util.concurrent.ExecutorService interface provides methods to manage the thread pool. Although the interface lacks methods for finding the number of actively executing threads or for enumerating the threads, the logical grouping can help control the behavior of the group as a whole. For instance, invoking the shutdownPool() method terminates all threads belonging to a particular thread pool.

Code Block
bgColor#ccccff
public final class NetworkHandler {
  private final ExecutorService executor;

  NetworkHandler(int poolSize) {
    this.executor = Executors.newFixedThreadPool(poolSize);
  }

  public void startThreads() {
    for (int i = 0; i < 3; i++) {
      executor.execute(new HandleRequest());
    }
  }

  public void shutdownPool() {
    executor.shutdown();
  }

  public static void main(String[] args)  {
    NetworkHandler nh = new NetworkHandler(3);
    nh.startThreads();
    nh.shutdownPool();
  }
}

Before Java SE 5.0, applications that needed to catch an uncaught exception in a separate thread had to extend the ThreadGroup class because this was the only direct approach to provide the required functionality. Specifically, an application's UncaughtExceptionHandler could only be controlled by subclassing ThreadGroup. In more recent versions of Java, UncaughtExceptionHandler is maintained on a per-thread basis using an interface enclosed by the Thread class. Consequently, the ThreadGroup class provides little unique functionality [Goetz 2006], [Bloch 2008].

Refer to TPS03-J. Ensure that tasks executing in a thread pool do not fail silently for more information on using uncaught exception handlers in thread pools.

Risk Assessment

Use of the ThreadGroup APIs may result in race conditions, memory leaks, and inconsistent object state.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

THI01-J

Low

Probable

Medium

P4

L3

Automated Detection

ToolVersionCheckerDescription
Parasoft Jtest
Include Page
Parasoft_V
Parasoft_V
CERT.THI01.AUTGDo not use variables of the unsafe type 'java.lang.ThreadGroup'
SonarQube
Include Page
SonarQube_V
SonarQube_V
S3014"ThreadGroup" should not be used

Bibliography

[API 2006]

Class Thread
Class ThreadGroup:
  Method activeCount
  Method enumerate

[Bloch 2001]

Item 53, "Avoid Thread Groups"

[Bloch 2008]

Item 73, "Avoid Thread Groups"

[Goetz 2006]

Section 7.3.1, "Uncaught Exception Handlers"

[JavaThreads 2004]

Section 13.1, "ThreadGroups"

[Java Tutorials]

[JPL 2006]

Section 23.3.3, "Shutdown Strategies"

[SDN 2006]

Bug ID 4089701
Bug ID 4229558


...

Image Added Image Added Image Added