forked from wooyunwang/Fortify
-
Notifications
You must be signed in to change notification settings - Fork 1
/
竞争条件:单实例字段
43 lines (43 loc) · 1.38 KB
/
竞争条件:单实例字段
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
竞争条件:单实例字段,Servlet 只有一个实例,并通过使用和重复使用该单个实例来处理需要由不同线程同时处理的多个请求。把用户数据存储在Servlet成员字段中会引发数据访问的race condition。
<b>修复建议</b>
定义局部变量存储数据,而不是定义全局变量共享数据。或者使用互斥锁对共享的数据进行排队限制。
<b>修复示例</b>
如:
<pre>
public class GuestBook extends HttpServlet {
String name;
protected void doPost (HttpServletRequest req, HttpServletResponse res) {
name = req.getParameter("name");
...
out.println(name + ", thanks for visiting!");
}
}
</pre>
修复为:
<pre>
public class GuestBook extends HttpServlet {
protected void doPost (HttpServletRequest req, HttpServletResponse res) {
GBRequestHandler handler = new GBRequestHandler();
handler.handle(req, res);
} }
public class GBRequestHandler {
String name;
public void handle(HttpServletRequest req, HttpServletResponse res) {
name = req.getParameter("name");
...
out.println(name + ", thanks for visiting!");
}
</pre>
或:
<pre>
public class GuestBook extends HttpServlet {
String name;
protected void doPost (HttpServletRequest req, HttpServletResponse res) {
synchronized(name) {
name = req.getParameter("name");
}
...
out.println(name + ", thanks for visiting!");
}
}
</pre>