[jboss-jira] [JBoss JIRA] (ELY-609) Unguarded read in ElytronPolicyConfiguration

[Jan Kalina (JIRA)]

    [ https://issues.jboss.org/browse/ELY-609?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13503497#comment-13503497 ] 

Jan Kalina edited comment on ELY-609 at 12/8/17 10:18 AM:
----------------------------------------------------------

Not sure how do you mean "more than one lock", as all in ElytronPolicyConfiguration is synchronized against "this", -but the problem I see is, even when I add synchonized block around getters, the obtained Permissions object will not be immutable - user will be able to modify Permissions collection without any sychronization...-
(edit, just looking, the Permissions object is synchonized)


was (Author: honza889):
Not sure how do you mean "more than one lock", as all in ElytronPolicyConfiguration is synchronized against "this", but the problem I see is, even when I add synchonized block around getters, the obtained Permissions object will not be immutable - user will be able to modify Permissions collection without any sychronization...

> Unguarded read in ElytronPolicyConfiguration
> --------------------------------------------
>
>                 Key: ELY-609
>                 URL: https://issues.jboss.org/browse/ELY-609
>             Project: WildFly Elytron
>          Issue Type: Bug
>    Affects Versions: 1.1.0.Beta7
>            Reporter: Ondrej Lukas
>            Assignee: Jan Kalina
>              Labels: static_analysis
>             Fix For: 1.2.0.Beta12
>
>
> Access to fields {{uncheckedPermissions}}, {{excludedPermissions}} and {{rolePermissions}} in {{org.wildfly.security.authz.jacc.ElytronPolicyConfiguration}} is holded by lock. However lock is not used in their getter methods. Getters should be also handled by locks to avoid unguarded read of those fields.



--
This message was sent by Atlassian JIRA
(v7.5.0#75005)