Page History

public final 

It is critical to ensure that threads are activated correctly. Thread activation can be misleading because sometimes the code appears to be performing the function correctly, whereas it may be operating in the presence of subtle concurrency issues.

It is usually a mistake to invoke the {{run()}} method on a {{Thread}} object. When invoked directly, the statements in the {{run()}} method execute, however, in the current thread instead of the newly created thread. Furthermore, if the {{Thread}} object is not constructed from a {{Runnable}} object but by instantiating a subclass of {{Thread}} that does not override the {{run()}} method, a call to the subclass's {{run()}} method invokes {{Thread.run()}} which does not perform any useful operations.

{mc}
// Hidden text: What does this line mean? 
It is recommended that if you have a {{Thread}} object that extends {{Runnable}}, and you wish to execute the object's {{run()}} method in the current thread, first cast the object to a {{Runnable}} and then invoke {{run()}}.
{mc}

h2. Noncompliant Code Example

The {{run()}} method of interface {{Runnable}} must be invoked in its own thread, however, this noncompliant code example explicitly invokes it in the context of the current thread. 

{code:bgColor=#FFCCCC}
class Foo implements Runnable {
  @Override public void run() {
    // ...
  }
  
  public static void main(String[] args) {
    Foo ffoo = new fooFoo();
    new Thread(ffoo).run();
  }
}
{code}

The {{start()}} method is not invoked on the new thread because of the incorrect assumption that {{run()}} activates the thread. Consequently, the statements in the {{run()}} method execute, however, in the same thread instead of the new one.

h2. Compliant Solution

This compliant solution correctly uses the {{start()}} method to start a new thread which then executes the {{run()}} method.

{code:bgColor=#ccccff}

public final class Foo implements Runnable {
  @Override public void run() {
    // ...
  }
  
  public static void main(String[] args) {
    Foo ffoo = new fooFoo();
    new Thread(ffoo).start();
  }
}
{code}

h2. Exceptions

*EX1*: The {{Thread.run()}} method may be used when unit testing the functionality of the {{run()}} method of a class. Note that a class cannot be tested for multithreaded use by invoking {{Thread.run()}}.

h2. Risk Assessment

Failing to activate threads correctly can cause unexpected behavior.

|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| CON05- J | low | probable | medium | {color:green}{*}P4{*}{color} | {color:green}{*}L3{*}{color} |

h3. Automated Detection

TODO

h3. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+CON08-J].

h2. References

\[[API 06|AA. Java References#API 06]\] Interface {{Runnable}} and class {{Thread}}

----
[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|CON04-J. Synchronize using an internal private final lock object]      [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|11. Concurrency (CON)]      [!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|VOID CON06-J. Do not defer a thread that is holding a lock]

public void sampleRunTest() {

  Thread thread = new Thread(new Runnable() {
      @Override public void run() {
        // ...
      }
    });
  
  ((Runnable) thread).run();  // THI00-J-EX0: Does not start a new thread

}