xerofun/owaspantisamy

No thread safe way to create a Policy

Closed this issue · 3 comments

With anti samy, there is no thread safe way to create a policy file.  The
Policy.getInstance(...) methods all read/write from the private _instance
variable without synchronization.  If two threads are creating policy files
(even with the same file/filename) there is potential for conflict, see
http://www.ibm.com/developerworks/java/library/j-dcl.html , in particular
the section on out of order writes.  

I think the _instance variable in Policy can be removed altogether.

Original issue reported on code.google.com by sean.bri...@gmail.com on 22 Jun 2009 at 8:50

[deleted comment]

Original comment by arshan.d...@gmail.com on 3 Aug 2009 at 2:28

Fixed. Thanks for the report!

Original comment by arshan.d...@gmail.com on 3 Aug 2009 at 2:34

  • Changed state: Fixed