JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
Java


JAVA.CONCURRENCY.LOCK.ISTR : Synchronization on Interned String (Java)

Summary

Synchronisation occurs on an interned string.

Concurrency is an important but complex aspect of modern software. As a consequence, it is often used in an incorrect way, also because the subtleties of the Java memory model are not always understood. This checker identifies a large class of common programming errors due to incorrect uses of concurrency primitives, such as incorrect implementations of the singleton pattern and incorrect uses of the volatile field modifier, whose goal is to publish a field update to all executing cores. The latter, however, has a cost in terms of execution time.

Properties

Class Name Synchronization on Interned String (Java)
Significance reliability
Mnemonic JAVA.CONCURRENCY.LOCK.ISTR
Categories
CWE CWE:366 Race Condition within a Thread
  CWE:412 Unrestricted Externally Accessible Lock
CERT-Java CERT-Java:LCK00-J Use private final lock objects to synchronize classes that may interact with untrusted code
OWASP-2021 OWASP-2021:A4 Insecure design
OWASP-2025 OWASP-2025:A06 Insecure Design
Availability Available for Java and Kotlin.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Synchronization on Interned String (Java)"

Example

import java.util.HashMap;
import java.util.Map;

public class TestConcurrency {
  private static TestConcurrency instance;
  private final static Object lock1 = new Object();
  private volatile String lock2 = "lock";                      // Useless volatile Modifier (Java) warning issued here
  private String lock3 = new String("lock");
  private String lock4 = new String("lock").intern();
  private volatile Map<String, Integer> map = new HashMap<>(); // Useless volatile Modifier (Java) warning issued here (multiple instances)

  private TestConcurrency() {}

  public static TestConcurrency getInstance1() {
      if (instance == null)
          instance = new TestConcurrency(); // Double-Checked Locking (Java) warning issued here (Java)
      return instance;
  }

  public static TestConcurrency getInstance2() {
      synchronized (lock1) {
          if (instance == null)
              instance = new TestConcurrency();
      }
      return instance;
  }

  public static TestConcurrency getInstance3() {
      if (instance == null)
          synchronized (lock1) {
              if (instance == null)
                  instance = new TestConcurrency();
          }
      return instance;
  }

  private int counter;

  private int next() {
      map.put(String.valueOf(++counter), counter);
      return counter;
  }

  public int step(int i) {
      synchronized (lock1) {              // Useless Synchronization (Java) warning issued here
          i++;
      }
      return i;
  }

  public int test1() {
      synchronized (lock2) {              // Synchronization on Interned String (Java) warning issued here
          return next();
      }
  }

  public int test2() {
      synchronized (lock3) {
          return next();
      }
  }

  public int test3() {
      synchronized (lock4) {              // Synchronization on Interned String (Java) warning issued here
          return next();
      }
  }

  public int callTest6() {
      return test6(lock2);
  }

  public int test6(String s) {
      synchronized (s) {                   // Synchronization on Interned String (Java) warning issued here
          return next();
      }
  }
}

Resolution

Check if the warnings correspond to actual possible errors for a concurrent execution of the program.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

 

To report problems with this documentation, please visit https://support.codesecure.com/.