Skip to content

Fix the error-level CodeQL findings: dead branches, a null factory, interned-string locks, racy lazy init - #132

Open
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:codeql-error-batch
Open

vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:codeql-error-batch

Conversation

@vharseko

Copy link
Copy Markdown
Member

Closes the 11 open CodeQL alerts of severity error that carry no security rating: java/contradictory-type-checks #1536 #1537, java/dereferenced-value-is-always-null #1560, java/sync-on-boxed-types #1554 #1555 #1556, java/unsafe-double-checked-locking #1549 #1550 #1551, java/unsynchronized-getter #1544 #1545.

Where Finding Change
SQLUtil.setParam else if (val instanceof Integer) appears twice; the second branch can never run second branch removed
ContractITCase.createInstances IObjectFactory objectFactory = null is dereferenced for any test class with a (String) constructor — today none of the default classes has one, so it only worked because the NoSuchMethodException path was always taken new ObjectFactoryImpl() (TestNG's default), and the unused nested ContractTestFactory with its three never-read fields is gone
BatchRemoteCache (testbundlev1) synchronized (resultLock) on the interned literal "resultLock" — a monitor shared with any other code in the JVM that synchronises on the same string new Object()
WebSocketConnectionGroup.operationContext, ScriptedConfiguration.groovyScriptEngine, TstStatefulConnectorConfig.executorService double-checked lazy initialisation reading a non-volatile field outside the lock: a thread may see a partially constructed object fields declared volatile, which makes the pattern correct under the JMM
FrameworkUtil.getFrameworkVersion() unsynchronised lazy init while setFrameworkVersion is synchronised static synchronized (not a hot path). The (ClassLoader) overload reads connectors-framework.properties rather than the field and is only used by FrameworkUtilTests; renamed to readFrameworkVersion so the getter/setter pairing no longer applies to it

No new tests: dead branches, volatile, a private monitor and a synchronised getter have no behaviour a unit test can observe, and createInstances takes its classes from a fixed list with no (String) constructors, so the null path cannot be reached from a test without restructuring the factory.

Local runs of the touched modules: connector-framework 189, dbcommon 43, connector-framework-server 29, groovy-connector 125 (42 skipped as on master), contract and testbundlev1 compile — all green.

…nterned-string locks, racy lazy init

SQLUtil tested "instanceof Integer" twice, the second branch unreachable.
ContractITCase dereferenced a factory that was always null; it now uses
TestNG's ObjectFactoryImpl, and the unused nested ContractTestFactory
goes. BatchRemoteCache synchronised on an interned string literal, a
monitor shared with any other code using the same literal; it locks a
private object now. The double-checked lazy initialisation of
WebSocketConnectionGroup.operationContext,
ScriptedConfiguration.groovyScriptEngine and
TstStatefulConnectorConfig.executorService reads a non-volatile field
outside the lock; the fields are volatile now. FrameworkUtil's version
getter is synchronised like its setter, and the class-loader overload,
which reads a resource rather than the field, is readFrameworkVersion.
@vharseko vharseko added the java Pull requests that update java code label Sep 18, 2026
@vharseko vharseko added framework OpenICF-java-framework connector:groovy Groovy connector dbcommon OpenICF-dbcommon refactoring Code cleanup / tech debt, no behavior change labels Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

connector:groovy Groovy connector dbcommon OpenICF-dbcommon framework OpenICF-java-framework java Pull requests that update java code refactoring Code cleanup / tech debt, no behavior change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant