SV.UMC.THREADS
This warning is reported when an application is using threads.
Vulnerability and risk
Thread management should be avoided in many cases. For example, the EJB standard contains the following guidelines: The enterprise bean must not attempt to manage threads. The enterprise bean must not attempt to start, stop, suspend, or resume a thread, or to change a thread's priority or name. The enterprise bean must not attempt to manage thread groups. Thread management in servlets is also very questionable and might lead to problems. On the other hand, threads are used in applets and other GUI applications. In this context, a warning serves not to report an error, but rather as a reminder to programmers to pay more attention to this code.
Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.
Mitigation and prevention
For EJB use framework approaches for parallel execution, instead of using threads.
Example 1
public class SV_UMC_THREADS_Sample_1 extends HttpServlet {
public void doPost(HttpServletRequest request,
HttpServletResponse response) throws IOException,
ServletException {
doProcessRequest(request, response);
}
public void doGet(HttpServletRequest request,
HttpServletResponse response) throws IOException,
ServletException {
doProcessRequest(request, response);
}
private void doProcessRequest(HttpServletRequest request,
HttpServletResponse response) throws IOException,
ServletException {
final StringBuffer buffer = new StringBuffer();
Runnable r = new Runnable() {
public void run() {
buffer.append("Processing...\n");
// do something
buffer.append("Finished.\n");
}
};
Thread t = new Thread(r);
t.start();
// do something else, then get results from background thread
try {
t.join();
} catch (InterruptedException e) {
}
String log = buffer.toString();
// create page...
}
}SV.UMC.THREADS is reported for calling 'Thread' constructor on line 36: Method 'Thread' is used. Thread management is deprecated in many cases (e.g. in EJBs). Also, it is always highly error prone SV.UMC.THREADS is reported for call on line 37: Method 'start' is used. Thread management is deprecated in many cases (e.g. in EJBs). Also, it is always highly error prone SV.UMC.THREADS is reported for call on line 40: Method 'join' is used. Thread management is deprecated in many cases (e.g. in EJBs). Also, it is always highly error prone
External guidance
Security training
Application security training materials provided by Secure Code Warrior.
