Gouri Sankar A created WW-5644:
----------------------------------
Summary: StrutsJSONWriter write state shared across concurrent
requests cross-request response leakage
Key: WW-5644
URL: https://issues.apache.org/jira/browse/WW-5644
Project: Struts 2
Issue Type: Bug
Components: Plugin - JSON
Affects Versions: 7.2.1
Environment: Reproducible under concurrent response serialization via
the default
"json" result type or JSONInterceptor, no special configuration
required. JDK 17, Jackson 2.22.0, any Servlet container. Confirmed via
a 16-thread contention test against a single shared StrutsJSONWriter
instance (44,646/320,000 corrupted responses observed pre-fix).
Reporter: Gouri Sankar A
JSONUtil's JSONWriter is injected once and reused across every
concurrent response handled by that JSONResult/JSONInterceptor.
StrutsJSONWriter kept its output buffer and other per-write state as
plain instance fields, reset in place at the start of write(). Two
concurrent write() calls race on that reset: one call's in-progress
buffer can be wiped and overwritten by a second call before the first
reads it back, so one request's serialized JSON can be returned as a
completely different, concurrently-served request's response body —
exercised by the default json result type on every request.
Fix: move per-write state into a ThreadLocal-confined object, scoped to
a single write() call.
Fixed by: https://github.com/apache/struts/pull/1776
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
