Bug 50554

Summary: Bad use of getClass() could potentially lead to concurrency bugs in future
Product: Tomcat 7 Reporter: Mohsen Vakilian <reprogrammer>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal CC: reprogrammer
Priority: P2    
Version: trunk   
Target Milestone: ---   
Hardware: All   
OS: All   

Description Mohsen Vakilian 2011-01-06 14:38:25 UTC
The method org.apache.naming.java.javaURLContextFactory.getInitialContext(Hashtable<?,?>) has a synchronized block on getClass(). Using getClass() as lock is a bug pattern because if some class subclasses javaURLContextFactory and getInitialContext gets called on an instance of such a subclass, getClass() will return a different Class object for that instance. Locking different objects for different classes is usually not the expected behavior. Therefore, I suggest to remove this bug pattern by simply replacing getClass() by javaURLContextFactory.class.

See https://www.securecoding.cert.org/confluence/display/java/LCK02-J.+Do+not+synchronize+on+the+class+object+returned+by+getClass%28%29 for more information about this bug pattern.

Keshmesh (https://github.com/reprogrammer/keshmesh/) is an Eclipse plugin that analyzes the source code of Java programs to detect concurrency bug patterns such the one I reported.
Comment 1 Mark Thomas 2011-01-07 05:32:45 UTC
Fixed in 7.0.x and will be included in 7.0.6

The issue was already reported by FindBugs. I fixed this issue and the handful of other FindBugs and Eclipse warnings in that class.