...
| Code Block | ||
|---|---|---|
| ||
public class SomeObject {
// Locks on the object's monitor
public synchronized void changeValue() {
// ...
}
public static SomeObject lookup(String name) {
// ...
}
}
// Untrusted code
String name = // ...
SomeObject someObject = SomeObject.lookup(name);
if (someObject == null) {
// ... handle error
}
synchronized (someObject) {
while (true) {
// Indefinitely delaylock someObject
Thread.sleep(Integer.MAX_VALUE);
}
}
|
...
Exposing the lock object to untrusted code can result in DoS.
Rule | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level |
|---|---|---|
LCK00-J | low | probable |
No | No |
P2 | L3 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Lock Checker | Concurrency and lock errors (see Chapter 6) | ||||||
| CodeSonar |
| JAVA.CONCURRENCY.LOCK.ISTR | Synchronization on Interned String (Java) | ||||||
| Parasoft Jtest |
| CERT.LCK00.SOPF | Do not synchronize on "public" fields since doing so may cause deadlocks | |||||||
| SonarQube |
|
|
| S2445 |
Related Guidelines
Bibliography
Item 52. Document Thread Safety |
...