[jboss-jira] [JBoss JIRA] Closed: (JBCOMMON-50) TimedCachePolicy leaks classloader to timer thread

[Brian Stansberry (JIRA)]

     [ https://jira.jboss.org/jira/browse/JBCOMMON-50?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Brian Stansberry closed JBCOMMON-50.
------------------------------------

    Resolution: Done


Done.

By default, the class now sets the current threads context classloader to the system classloader before creating the Timer. This is fine for the internal usage of this class, where the timer tasks just call System.currentTimeMillis() (in TimedCachePolicy.run()).

But, since common-core is a utility library and people may have subclassed TimedCachePolicy to do more in run(),[1] I added the ability to control what classloader is used. This can be done by setting the system property "jboss.common.timedcachepolicy.timer.classloader". Possible values are:

"system" -- use the system classloader (the default)
"current" -- use TimedCachePolicy.class.getClassLoader()
"context" -- use TCCL

If any SecurityException is thrown reading the system property or changing the TCCL, the old method is left in place.

[1] I looked in the AS codebase, including integrated libs, and saw no subclassing.

> TimedCachePolicy leaks classloader to timer thread
> --------------------------------------------------
>
>                 Key: JBCOMMON-50
>                 URL: https://jira.jboss.org/jira/browse/JBCOMMON-50
>             Project: JBoss Common
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: common-core (2.x)
>    Affects Versions: 2.2.4.GA,  2.2.5.beta1
>            Reporter: Brian Stansberry
>            Assignee: Brian Stansberry
>             Fix For: 2.2.12.GA
>
>         Attachments: JBCOMMON-50.patch
>
>
> TimedCachePolicy has a static reference to a Timer, restartTimer.  A timer creates a new thread when it is initialized; the thread inherits its TCCL from the TCCL of the thread that initializes it.  Effect is that TCCL leaks to the restartTimer's thread.
> Not sure the best solution here, since common-core is a general use library. In general I think the right solution is to set the TCCL to a "safe" classloader before creating the Timer, and restore the TCCL afterwards.  But what is a "safe" classloader?  If you use TimedCachePolicy.class.getClassLoader(), then that classloader is leaked.  That's fine in JBoss AS, but may be bad in other use cases.  Perhaps null or system classloader is the right choice; I don't know enough about how this class is used to have a good idea if the TimerTasks being used (seems to only be RestartTimer) need to load classes.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira