Race Condition: Singleton Member Field

ABSTRACT

Servlet 成員字段可能允許一個用戶查看其他用戶的數據。

EXPLANATION

許多 Servlet 開發人員都不了解 Servlet 為單例模式。Servlet 只有一個實例，并通過使用和重復使用該單個實例來處理需要由不同線程同時處理的多個請求。

這種誤解的共同后果是，開發者使用 Servlet 成員字段的這種方式會導致某個用戶可能在無意中看到其他用戶的數據。換言之，即把用戶數據存儲在 Servlet 成員字段中會引發數據訪問的 race condition。

例 1：以下 Servlet 把請求參數值存儲在成員字段中，然后將參數值返回給響應輸出流。

public class GuestBook extends HttpServlet {

String name;

protected void doPost (HttpServletRequest req,
HttpServletResponse res) {
name = req.getParameter("name");
     ...
out.println(name + ", thanks for visiting!");
   }
}

REFERENCES

[1] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A6 Information Leakage and Improper Error Handling

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3630.1 CAT II

[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3630.1 CAT II

[4] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 362, CWE ID 488

[5] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 362

[6] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 362

[7] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.5

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.5.6

[9] The Java Servlet Specification Sun Microsystems