[
https://issues.apache.org/jira/browse/WW-5831?focusedWorklogId=1053186&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053186
]
ASF GitHub Bot logged work on WW-5831:
--------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 08:08
Start Date: 07/Nov/26 08:08
Worklog Time Spent: 10m
Work Description: lukaszlenart merged PR #2089:
URL: https://github.com/apache/struts/pull/2089
Issue Time Tracking
-------------------
Worklog Id: (was: 1053186)
Time Spent: 20m (was: 10m)
> Make XSLT BeanAdapter property descriptor cache thread-safe
> ------------------------------------------------------------
>
> Key: WW-5831
> URL: https://issues.apache.org/jira/browse/WW-5831
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - XSLT
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In the XSLT plugin, BeanAdapter keeps a static, lazily created HashMap of
> PropertyDescriptors, guarded by a synchronized instance method. A BeanAdapter
> is created per bean per render, so the lock is never shared and the map is
> accessed without mutual exclusion. Under concurrent use the map's size was
> observed to exceed the number of distinct classes added (for example 4104 for
> 4095). This is hardening; no security impact was demonstrated. BeanAdapter is
> only used when an action renders the xslt result type, which needs the
> struts2-xslt-plugin. WW-5647 made the same kind of change for
> XSLTResult.templatesCache.
> Affected versions: the code pattern (a static, non-final
> propertyDescriptorCache created lazily as a HashMap and accessed from a
> synchronized instance method) is identical in the 6.12.0, 7.0.0, 7.3.0 and
> 7.4.0 tags, by source inspection. The concurrency test itself was only run on
> main.
> Fix: make the cache a static final ConcurrentHashMap and drop the lazy init
> and synchronized.
> Tests: BeanAdapterTest#testConcurrentAdaptersCacheEachBeanClassOnce. It fails
> without the fix and passes with it. It is statistical: it can pass without
> the fix on a fast machine.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
