[
https://issues.jboss.org/browse/ELY-609?page=com.atlassian.jira.plugin.sy...
]
Jan Kalina edited comment on ELY-609 at 12/8/17 10:18 AM:
----------------------------------------------------------
Not sure how do you mean "more than one lock", as all in
ElytronPolicyConfiguration is synchronized against "this", -but the problem I
see is, even when I add synchonized block around getters, the obtained Permissions object
will not be immutable - user will be able to modify Permissions collection without any
sychronization...-
(edit, just looking, the Permissions object is synchonized)
was (Author: honza889):
Not sure how do you mean "more than one lock", as all in
ElytronPolicyConfiguration is synchronized against "this", but the problem I see
is, even when I add synchonized block around getters, the obtained Permissions object will
not be immutable - user will be able to modify Permissions collection without any
sychronization...
Unguarded read in ElytronPolicyConfiguration
--------------------------------------------
Key: ELY-609
URL:
https://issues.jboss.org/browse/ELY-609
Project: WildFly Elytron
Issue Type: Bug
Affects Versions: 1.1.0.Beta7
Reporter: Ondrej Lukas
Assignee: Jan Kalina
Labels: static_analysis
Fix For: 1.2.0.Beta12
Access to fields {{uncheckedPermissions}}, {{excludedPermissions}} and
{{rolePermissions}} in {{org.wildfly.security.authz.jacc.ElytronPolicyConfiguration}} is
holded by lock. However lock is not used in their getter methods. Getters should be also
handled by locks to avoid unguarded read of those fields.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)