[
https://issues.apache.org/jira/browse/WW-5009?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16758887#comment-16758887
]
ASF GitHub Bot commented on WW-5009:
------------------------------------
JCgH4164838Gh792C124B5 commented on pull request #326: Potential mitigation for
WW-5009
URL: https://github.com/apache/struts/pull/326
Potential mitigation for WW-5009
- Add synchronization guard to problematic JSONUtil instances in
JSONInterceptor, JSONResult:
- Guarding the two calls to jsonUtil.serialize() appears sufficient based
on WW-5009 interactive reproducer test.
- Should preserve functionality for WW-4034 (custom JSONWriter).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> EmptyStackException in JSON plugin due to concurrency
> -----------------------------------------------------
>
> Key: WW-5009
> URL: https://issues.apache.org/jira/browse/WW-5009
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - JSON
> Affects Versions: 2.5.20
> Environment: JDK 1.8_0_191
> Tomcat 9.0.12
> Reporter: Eduardo Quintanilla
> Assignee: Yasser Zamani
> Priority: Critical
> Labels: json, json-rpc
> Fix For: 2.5.21, 2.6
>
> Attachments: logs.txt, struts-json-example-master.zip
>
>
> EmptyStackException in JSON plugin due to concurrency
> Note: The issue was found in an app that was upgraded from version 2.3.34
> Logs: [^logs.txt]
> I created a sample application that should help reproducing the error.
> [^struts-json-example-master.zip]
> The error happened opening the app (localhost/struts-json-example) in 4
> different browsers / sessions.
> As a workaround I have overridden the JSONInterceptor so a new instance of
> JSONUtil is used with every request and the issue is not happening anymore. I
> suppose there is a performance cost with that change but for now it works.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
