Race Condition: Format Flaw

ABSTRACT

java.text.Format 中的 parse() 和 format() 方法包含一個可導致用戶看到其他用戶數據的設計缺陷。

EXPLANATION

java.text.Format 中的 parse() 和 format() 方法包含一個可導致用戶看到其他用戶數據的 race condition。

例 1： 以下代碼顯示了此設計缺陷如何暴露自己。

public class Common {
    
private static SimpleDateFormat dateFormat;
    ...
    
public String format(Date date) {
return dateFormat.format(date);
    }
    ...

final OtherClass dateFormatAccess=new OtherClass();
    ...

public void function_running_in_thread1(){
System.out.println("Time in thread 1 should be 12/31/69 4:00 PM, found:"+ dateFormatAccess.format(new Date(0)));
    }

public void function_running_in_thread2(){
System.out.println("Time in thread 2 should be around 12/29/09 6:26 AM, found:"+ dateFormatAccess.format(new Date(System.currentTimeMillis())));
    }
}

盡管此代碼可在單一用戶環境中正常運行，但如果兩個線程同時運行此代碼，則會生成以下輸出內容：

Time in thread 1 should be 12/31/69 4:00 PM, found:12/31/69 4:00 PM
Time in thread 2 should be around 12/29/09 6:26 AM, found:12/31/69 4:00 PM

在這種情況下，第一個線程中的數據顯示在了第二個線程的輸出中，原因是實施的 format() 中存在 race condition。

REFERENCES

[1] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A6 Information Leakage and Improper Error Handling

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3630.1 CAT II

[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3630.1 CAT II

[4] Bug 4228335 :SimpleDateFormat is not threadsafe Sun Microsystems

[5] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 362, CWE ID 488

[6] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 362

[7] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 362

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.5

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.5.6

[10] The Java Servlet Specification Sun Microsystems

97av