Conversation
…nterned-string locks, racy lazy init SQLUtil tested "instanceof Integer" twice, the second branch unreachable. ContractITCase dereferenced a factory that was always null; it now uses TestNG's ObjectFactoryImpl, and the unused nested ContractTestFactory goes. BatchRemoteCache synchronised on an interned string literal, a monitor shared with any other code using the same literal; it locks a private object now. The double-checked lazy initialisation of WebSocketConnectionGroup.operationContext, ScriptedConfiguration.groovyScriptEngine and TstStatefulConnectorConfig.executorService reads a non-volatile field outside the lock; the fields are volatile now. FrameworkUtil's version getter is synchronised like its setter, and the class-loader overload, which reads a resource rather than the field, is readFrameworkVersion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the 11 open CodeQL alerts of severity
errorthat carry no security rating:java/contradictory-type-checks#1536 #1537,java/dereferenced-value-is-always-null#1560,java/sync-on-boxed-types#1554 #1555 #1556,java/unsafe-double-checked-locking#1549 #1550 #1551,java/unsynchronized-getter#1544 #1545.SQLUtil.setParamelse if (val instanceof Integer)appears twice; the second branch can never runContractITCase.createInstancesIObjectFactory objectFactory = nullis dereferenced for any test class with a(String)constructor — today none of the default classes has one, so it only worked because theNoSuchMethodExceptionpath was always takennew ObjectFactoryImpl()(TestNG's default), and the unused nestedContractTestFactorywith its three never-read fields is goneBatchRemoteCache(testbundlev1)synchronized (resultLock)on the interned literal"resultLock"— a monitor shared with any other code in the JVM that synchronises on the same stringnew Object()WebSocketConnectionGroup.operationContext,ScriptedConfiguration.groovyScriptEngine,TstStatefulConnectorConfig.executorServicevolatile, which makes the pattern correct under the JMMFrameworkUtil.getFrameworkVersion()setFrameworkVersionis synchronisedstatic synchronized(not a hot path). The(ClassLoader)overload readsconnectors-framework.propertiesrather than the field and is only used byFrameworkUtilTests; renamed toreadFrameworkVersionso the getter/setter pairing no longer applies to itNo new tests: dead branches,
volatile, a private monitor and a synchronised getter have no behaviour a unit test can observe, andcreateInstancestakes its classes from a fixed list with no(String)constructors, so the null path cannot be reached from a test without restructuring the factory.Local runs of the touched modules: connector-framework 189, dbcommon 43, connector-framework-server 29, groovy-connector 125 (42 skipped as on master), contract and testbundlev1 compile — all green.