Reino: Time and State

A computação distribuída consiste em tempo e estado. Isto é, para que mais de um componente se comunique, é necessário compartilhar o estado, o que exige tempo.

A maioria dos programadores antropomorfiza seu trabalho. Eles enxergam um thread de controle executando todo o programa da mesma forma como enxergariam a si mesmos fazendo o trabalho inteiro por conta própria. Computadores modernos, entretanto, alternam entre tarefas com muita rapidez e, em sistemas multi-core, multi-CPU ou distribuídos, dois eventos podem ocorrer exatamente ao mesmo tempo. Defeitos rapidamente são postos nas lacunas entre o modelo do programador de como um programa é executado e o que ocorre na realidade. Esses defeitos estão relacionados com interações inesperadas entre threads, processos, tempo e informações. Essas interações ocorrem por meio de estados compartilhados: semáforos, variáveis, o sistema de arquivos e, basicamente, todas as coisas capazes de armazenar informações.

Race Condition: Static Database Connection

Java/JSP

Abstract

Conexões de banco de dados armazenadas em campos estáticos serão compartilhadas entre threads.

Explanation

Um objeto de recurso transacional, como uma conexão de banco de dados, só pode ser associado a uma transação de cada vez. Por esse motivo, uma conexão não deve ser compartilhada entre threads e não deve ser armazenada em um campo estático. Consulte a Seção 4.2.3 da Especificação J2EE para obter mais detalhes.

Exemplo 1:


public class ConnectionManager {

private static Connection conn = initDbConn();
...
}

References

[1] Java 2 Platform Enterprise Edition Specification, v1.4 Sun Microsystems

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1.0

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3.1

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark partial

[7] Standards Mapping - Common Weakness Enumeration CWE ID 362, CWE ID 567

[8] Standards Mapping - Common Weakness Enumeration Top 25 2022 [22] CWE ID 362

[9] Standards Mapping - Common Weakness Enumeration Top 25 2023 [21] CWE ID 362

[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001090, CCI-003178

[11] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[12] Standards Mapping - NIST Special Publication 800-53 Revision 4 CM-6 Configuration Settings (P1), SC-4 Information in Shared Resources (P1)

[13] Standards Mapping - NIST Special Publication 800-53 Revision 5 CM-6 Configuration Settings, SC-4 Information in Shared System Resources

[14] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.11.2 Business Logic Architectural Requirements (L2 L3)

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.3 - Terminal Software Attack Mitigation

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.3 - Terminal Software Attack Mitigation

[24] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 362

[25] Standards Mapping - SANS Top 25 2010 Insecure Interaction - CWE ID 362

[26] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3630.1 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3630.1 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3630.1 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3630.1 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3630.1 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3630.1 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3630.1 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

desc.structural.java.race.dbconn