Page History

 try to forcefully terminate threads when they believe that the task is accomplished, the request has been canceled or the program or JVM needs to quickly shut down. 

A few thread APIs were introduced to facilitate thread suspension, resumption and termination but were later deprecated because of inherent design weaknesses. The {{Thread.stop()}} method is one example. It causes the thread to immediately throw a {{ThreadDeath}} exception, which usually stops the thread. 

Invoking {{Thread.stop()}} results in the release of all the locks a thread has acquired which may corrupt the state of the object. The thread could catch the {{ThreadDeath}} exception and use a {{finally}} block in an attempt to repair the inconsistent object, however, this requires careful inspection of all the synchronized methods and blocks because a {{ThreadDeath}} exception can be thrown at any point during the thread's execution. Furthermore, code must be protected from {{ThreadDeath}} exceptions that may result when executing the {{catch}} or {{finally}} blocks \[[Sun 99|AA. Java References#Sun 99]\].

More information about deprecated methods is available in [MET15-J. Do not use deprecated or obsolete methods]. Also, refer to [EXC09-J. Prevent inadvertent calls to System.exit() or forced shutdown] for information on preventing data corruption when the JVM is abruptly shut down.

     
h2. Noncompliant Code Example (Deprecated {{Thread.stop()}})

This noncompliant code example shows a thread that fills a vector with pseudorandom numbers. The thread is forcefully stopped after a given amount of time.

{code:bgColor=#FFcccc}
public final class Container implements Runnable {
  private final Vector<Integer> vector = new Vector<Integer>(1000);

  public Vector<Integer> getVector() {
    return vector;
  }

  
@Override  public synchronized void run() {
    Random number = new Random(123L);
    int i = vector.capacity();
    while (i > 0) {
      vector.add(number.nextInt(100));
      i--;
    }    
  }

  public static void main(String[] args) throws InterruptedException {
    Thread thread = new Thread(new Container());
    thread.start();
    Thread.sleep(5000);
    thread.stop();
  }
}
{code}

[API 06|AA. Java References#API 06]\]. If the thread is in the process of adding a new integer to the vector when it is stopped, the vector may become accessible while it is in an inconsistent state. For example, {{Vector.size()}} may return two even though the vector contains three elements (as the element count is incremented after adding the element).


h2. Compliant Solution ({{volatile}} flag)

This compliant solution uses a {{volatile}} flag to stop the thread. An accessor method {{shutdown()}} is used to set the flag to {{true}}. The thread's {{run()}} method polls the {{done}} flag, and terminates when it becomes {{true}}.

{code:bgColor=#ccccff}
public final class Container implements Runnable {
  private final Vector<Integer> vector = new Vector<Integer>(1000);
  private volatile boolean done = false;
  
  public Vector<Integer> getVector() {
    return vector;
  }
  
  public void shutdown() {
    done = true;
  }

  @Override public synchronized void run() {
    Random number = new Random(123L);
    int i = vector.capacity();
    while (!done && i > 0) {
      vector.add(number.nextInt(100));
      i--;
    }
  }

  public static void main(String[] args) throws InterruptedException {
    Container container = new Container();
    Thread thread = new Thread(container);
    thread.start();
    Thread.sleep(5000);
    container.shutdown();
  }
}
{code} 


h2. Compliant Solution 

public final

This compliant solution stops the thread using the {{Thread.interrupt()}} method. 

{code:bgColor=#ccccff}
public class Container implements Runnable {
  private final Vector<Integer> vector = new Vector<Integer>(1000);
	  
  public Vector<Integer> getVector() {
    return vector;
  }

  @Override public synchronized void run() {
    Random number = new Random(123L);
    int i = vector.capacity();
    while (!Thread.interrupted() && i > 0) {
      vector.add(number.nextInt(100));
      i--;
    }
  }

  public static void main(String[] args) throws InterruptedException {
    Container c = new Container();
    Thread thread = new Thread(c);
    thread.start();
    Thread.sleep(5000);
    thread.interrupt();
  }
}
{code}

This method interrupts the current thread, however, it only stops the thread because the code polls the interrupted flag using the method {{Thread.interrupted()}}.

Upon receiving the interruption, the interrupted status of the thread is cleared and an {{InterruptedException}} is thrown. No guarantees are provided by the JVM on when the interruption will be detected by blocking methods such as {{Thread.sleep()}} and {{Object.wait()}}.  A thread may use interruption for performing tasks other than cancellation and shutdown. Consequently, a thread should not be interrupted unless its [interruption policy|BB. Definitions#interruption policy] is known in advance. Failure to follow this advice can result in failed interruption requests {mc} I don't think this is true ~DS -> the corruption of mutable shared state. {mc}


h2. Compliant Solution ({{RuntimePermission stopThread}})

Remove the default permission {{java.lang.RuntimePermission}} {{stopThread}} from the security policy file to deny the {{Thread.stop()}} invoking code, the required privileges. 


h2. Risk Assessment

Forcing a thread to stop can result in inconsistent object state. Critical resources may also leak if clean-up operations are not carried out as required.

|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| CON13- J | low | probable | medium | {color:green}{*}P4{*}{color} | {color:green}{*}L3{*}{color} |



h3. Automated Detection

TODO



h3. Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the [CERT website|https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+CON35-J].

h2. References

\[[API 06|AA. Java References#API 06]\] Class Thread, method {{stop}}, interface ExecutorService
\[[Sun 99|AA. Java References#Sun 99]\] 
\[[Darwin 04|AA. Java References#Darwin 04]\] 24.3 Stopping a Thread
\[[JDK7 08|AA. Java References#JDK7 08]\] Concurrency Utilities, More information: Java Thread Primitive Deprecation 
\[[JPL 06|AA. Java References#JPL 06]\] 14.12.1. Don't stop and 23.3.3. Shutdown Strategies
\[[JavaThreads 04|AA. Java References#JavaThreads 04]\] 2.4 Two Approaches to Stopping a Thread
\[[Goetz 06|AA. Java References#Goetz 06]\] Chapter 7: Cancellation and shutdown

----
[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_left.png!|CON12-J. Avoid deadlock by requesting and releasing locks in the same order]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_up.png!|11. Concurrency (CON)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Sun Microsystems Secure Coding Standard for Java^button_arrow_right.png!|CON15-J. Ensure actively held locks are released on exceptional conditions]