[
https://issues.apache.org/jira/browse/WW-5831?focusedWorklogId=1051642&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051642
]
ASF GitHub Bot logged work on WW-5831:
--------------------------------------
Author: ASF GitHub Bot
Created on: 31/Oct/26 14:51
Start Date: 31/Oct/26 14:51
Worklog Time Spent: 10m
Work Description: g0w6y opened a new pull request, #2089:
URL: https://github.com/apache/struts/pull/2089
Fixes [WW-5831](https://issues.apache.org/jira/browse/WW-5831)
Hardening, no behaviour change. `BeanAdapter.propertyDescriptorCache` is a
static, lazily created `HashMap` guarded by a `synchronized` instance method.
Each render creates its own `BeanAdapter`, so the lock is never shared. It is
now a `static final ConcurrentHashMap`, and the lazy-init block and
`synchronized` are removed. Same approach as WW-5647 (#1781) for
`XSLTResult.templatesCache`.
`BeanAdapterTest#testConcurrentAdaptersCacheEachBeanClassOnce` has 16
threads fetch descriptors for 4,095 distinct bean classes and asserts exactly
4,095 entries were added. Without the change it failed 28/28 runs, with the
cache size above the class count by a varying amount (observed 4100 to 4114 in
28 runs; it varies per run). With the change it passed 20/20.
The test is statistical: it can pass without the fix on a fast machine (an
earlier 500-class variant did in some runs), but it never fails with the fix.
The classes are `java.lang.reflect.Proxy` classes over every non-empty subset
of 12 JDK interfaces, all in the test class loader, so no class loaders are
created.
Not changed: no bound is added to the cache. Not claiming a security issue
or data exposure; only the corrupted map size was measured. The matching
`ScopeInterceptor` change is #2082.
xslt plugin module on the rebased branch (clean build): 18 tests, 0
failures. With only the production change reverted, `BeanAdapterTest` fails.
Issue Time Tracking
-------------------
Worklog Id: (was: 1051642)
Remaining Estimate: 0h
Time Spent: 10m
> Make XSLT BeanAdapter property descriptor cache thread-safe
> ------------------------------------------------------------
>
> Key: WW-5831
> URL: https://issues.apache.org/jira/browse/WW-5831
> Project: Struts 2
> Issue Type: Improvement
> Components: Plugin - XSLT
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Time Spent: 10m
> Remaining Estimate: 0h
>
> In the XSLT plugin, BeanAdapter keeps a static, lazily created HashMap of
> PropertyDescriptors, guarded by a synchronized instance method. A BeanAdapter
> is created per bean per render, so the lock is never shared and the map is
> accessed without mutual exclusion. Under concurrent use the map's size was
> observed to exceed the number of distinct classes added (for example 4104 for
> 4095). This is hardening; no security impact was demonstrated. BeanAdapter is
> only used when an action renders the xslt result type, which needs the
> struts2-xslt-plugin. WW-5647 made the same kind of change for
> XSLTResult.templatesCache.
> Affected versions: the code pattern (a static, non-final
> propertyDescriptorCache created lazily as a HashMap and accessed from a
> synchronized instance method) is identical in the 6.12.0, 7.0.0, 7.3.0 and
> 7.4.0 tags, by source inspection. The concurrency test itself was only run on
> main.
> Fix: make the cache a static final ConcurrentHashMap and drop the lazy init
> and synchronized.
> Tests: BeanAdapterTest#testConcurrentAdaptersCacheEachBeanClassOnce. It fails
> without the fix and passes with it. It is statistical: it can pass without
> the fix on a fast machine.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
