[
https://issues.apache.org/jira/browse/WW-5831?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5831:
------------------------------
Fix Version/s: 7.5.0
> Make XSLT BeanAdapter property descriptor cache thread-safe
> ------------------------------------------------------------
>
> Key: WW-5831
> URL: https://issues.apache.org/jira/browse/WW-5831
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - XSLT
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> In the XSLT plugin, BeanAdapter keeps a static, lazily created HashMap of
> PropertyDescriptors, guarded by a synchronized instance method. A BeanAdapter
> is created per bean per render, so the lock is never shared and the map is
> accessed without mutual exclusion. Under concurrent use the map's size was
> observed to exceed the number of distinct classes added (for example 4104 for
> 4095). This is hardening; no security impact was demonstrated. BeanAdapter is
> only used when an action renders the xslt result type, which needs the
> struts2-xslt-plugin. WW-5647 made the same kind of change for
> XSLTResult.templatesCache.
> Affected versions: the code pattern (a static, non-final
> propertyDescriptorCache created lazily as a HashMap and accessed from a
> synchronized instance method) is identical in the 6.12.0, 7.0.0, 7.3.0 and
> 7.4.0 tags, by source inspection. The concurrency test itself was only run on
> main.
> Fix: make the cache a static final ConcurrentHashMap and drop the lazy init
> and synchronized.
> Tests: BeanAdapterTest#testConcurrentAdaptersCacheEachBeanClassOnce. It fails
> without the fix and passes with it. It is statistical: it can pass without
> the fix on a fast machine.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
