Gouri Sankar A created WW-5831:
----------------------------------
Summary: Make XSLT BeanAdapter property descriptor cache
thread-safe
Key: WW-5831
URL: https://issues.apache.org/jira/browse/WW-5831
Project: Struts 2
Issue Type: Improvement
Components: Plugin - XSLT
Affects Versions: 7.4.0, 7.3.0, 7.0.0, 6.12.0
Reporter: Gouri Sankar A
In the XSLT plugin, BeanAdapter keeps a static, lazily created HashMap of
PropertyDescriptors, guarded by a synchronized instance method. A BeanAdapter
is created per bean per render, so the lock is never shared and the map is
accessed without mutual exclusion. Under concurrent use the map's size was
observed to exceed the number of distinct classes added (for example 4104 for
4095). This is hardening; no security impact was demonstrated. BeanAdapter is
only used when an action renders the xslt result type, which needs the
struts2-xslt-plugin. WW-5647 made the same kind of change for
XSLTResult.templatesCache.
Affected versions: the code pattern (a static, non-final
propertyDescriptorCache created lazily as a HashMap and accessed from a
synchronized instance method) is identical in the 6.12.0, 7.0.0, 7.3.0 and
7.4.0 tags, by source inspection. The concurrency test itself was only run on
main.
Fix: make the cache a static final ConcurrentHashMap and drop the lazy init and
synchronized.
Tests: BeanAdapterTest#testConcurrentAdaptersCacheEachBeanClassOnce. It fails
without the fix and passes with it. It is statistical: it can pass without the
fix on a fast machine.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
