Commit 3c5d3e1
Fix issue #58: CRITICAL TOCTOU race condition in cache checks
Fixed Time-Of-Check-Time-Of-Use race condition that could cause
NullPointerException in concurrent class loading scenarios.
**Problem:**
Thread A: containsKey(key) → true
Thread B: remove(key) → removes entry
Thread A: get(key) → returns NULL → NPE!
Even though ConcurrentHashMap is thread-safe, two separate operations
(containsKey + get) are not atomic together.
**Files Fixed:**
1. NexusClassSource.java - loadFromMaven() method
2. MavenRepositoryClassSource.java - loadClassData() method
3. MavenNexusClassSource.java - loadClassData() method
**Fix:**
Replaced:
if (cache.containsKey(key)) {
return cache.get(key); // Can return null!
}
With atomic single operation:
byte[] data = cache.get(key);
if (data != null) {
return data;
}
This eliminates the race window between check and use.
All 377 tests pass.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>1 parent 6d4ed04 commit 3c5d3e1
3 files changed
Lines changed: 12 additions & 6 deletions
File tree
- src/main/java/org/flossware/jclassloader
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
72 | 72 | | |
73 | 73 | | |
74 | 74 | | |
75 | | - | |
76 | | - | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
77 | 79 | | |
78 | 80 | | |
79 | 81 | | |
| |||
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
67 | 67 | | |
68 | 68 | | |
69 | 69 | | |
70 | | - | |
71 | | - | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
72 | 74 | | |
73 | 75 | | |
74 | 76 | | |
| |||
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
116 | 116 | | |
117 | 117 | | |
118 | 118 | | |
119 | | - | |
120 | | - | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
121 | 123 | | |
122 | 124 | | |
123 | 125 | | |
| |||
0 commit comments