界: Time and State

分散式運算與時間和狀態相關。也就是說，為了使多個元件進行通訊，必須共用狀態，並且這一切都需要時間。

大多數的程式設計師將他們的工作擬人化。他們想採用一種控制執行緒來執行整個程式，就像他們必須自己完成這項工作一樣。但是，現代的電腦可以非常快速地切換工作，並且在多核心多 CPU 或分散式系統中，兩個事件可能恰好同時發生。瑕疵急於填補程式設計師在程式執行模型與實際情況之間的差距。這些瑕疵與執行緒、處理序、時間和資訊之間的意外互動有關。這些互動透過共用狀態發生：信號、變數、檔案系統，以及基本上任何可以儲存資訊的項目。

Race Condition: Static Database Connection

Java/JSP

Abstract

靜態欄位中儲存的資料庫連線會在執行緒間共享。

Explanation

一個交易資源物件 (例如：資料庫連線) 一次只能與一個交易相關聯。由於這個原因，多個執行緒不應共用一個連線，並且不應該儲存在靜態欄位中。請參閱 J2EE Specification 的第 4.2.3 節以取得更多詳細資訊。

範例 1：


public class ConnectionManager {

private static Connection conn = initDbConn();
...
}

References

[1] Java 2 Platform Enterprise Edition Specification, v1.4 Sun Microsystems

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3.1

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - CIS Kubernetes Benchmark partial

[7] Standards Mapping - Common Weakness Enumeration CWE ID 362, CWE ID 567

[8] Standards Mapping - Common Weakness Enumeration Top 25 2022 [22] CWE ID 362

[9] Standards Mapping - Common Weakness Enumeration Top 25 2023 [21] CWE ID 362

[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001090, CCI-003178

[11] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[12] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-4 Information in Shared Resources (P1)

[13] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-4 Information in Shared System Resources

[14] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.11.2 Business Logic Architectural Requirements (L2 L3)

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[21] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.3 - Terminal Software Attack Mitigation

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.3 - Terminal Software Attack Mitigation

[24] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 362

[25] Standards Mapping - SANS Top 25 2010 Insecure Interaction - CWE ID 362

[26] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3630.1 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3630.1 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3630.1 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3630.1 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3630.1 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3630.1 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3630.1 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001995 CAT II, APSC-DV-002380 CAT II

desc.structural.java.race.dbconn