{"action":"created","issue":{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/329","labels_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/329/labels{/name}","comments_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/329/comments","events_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/329/events","html_url":"https://github.com/ESAPI/esapi-java-legacy/issues/329","id":48672749,"number":329,"title":"AbstractAccessReferenceMap.addDirectReference not invariant","user":{"login":"meg23","id":814859,"avatar_url":"https://avatars.githubusercontent.com/u/814859?v=3","gravatar_id":"","url":"https://api.github.com/users/meg23","html_url":"https://github.com/meg23","followers_url":"https://api.github.com/users/meg23/followers","following_url":"https://api.github.com/users/meg23/following{/other_user}","gists_url":"https://api.github.com/users/meg23/gists{/gist_id}","starred_url":"https://api.github.com/users/meg23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meg23/subscriptions","organizations_url":"https://api.github.com/users/meg23/orgs","repos_url":"https://api.github.com/users/meg23/repos","events_url":"https://api.github.com/users/meg23/events{/privacy}","received_events_url":"https://api.github.com/users/meg23/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/labels/imported","name":"imported","color":"FFFFFF"},{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/labels/Priority-Medium","name":"Priority-Medium","color":"FFFFFF"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-11-13T18:27:14Z","updated_at":"2016-01-17T05:35:35Z","closed_at":null,"body":"_From [filippo....@gmail.com](https://code.google.com/u/108620562346268162410/) on April 11, 2014 12:48:34_\n\nImplementation of addDirectReference may return a different value in case of concurrent calls for the same \"direct\" value.\r\n\r\n1.   public <T> K addDirectReference(T direct) {\r\n2.      if ( dtoi.keySet().contains( direct ) ) {\r\n3.         return dtoi.get( direct );\r\n4.      }\r\n5.      K indirect = getUniqueReference();\r\n6.      itod.put(indirect, direct);\r\n7.      dtoi.put(direct, indirect);\r\n8.      return indirect;\r\n9.   }\r\n\r\nIf two threads concurrently call addDirectReference, the indirect value returned may be different (can be verified by putting a sleep within the above method). As a result, itod will contain both the indirect values whereas dtoi will contain only the last one. As the indirect value is returned, one of the two threads will have a value that cannot be obtained anymore from addDirectReference.\r\n\r\nAlthough this is not strictly a bug, stating that the class is thread-safe leads to believe that its methods are invariant unless told otherwise. Multi-threaded scenarios where is expected that a given direct id always returns the same indirect id will experience erratic behaviour from this call, which will \"mostly\" return the same id but not always.\r\n\r\nWhether this is considered a bug or not is yours to decide. If it's not, then please put the proper way to use addDirectReference and getDirectReference into the documentation.\n\n_Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=325_"},"comment":{"url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/comments/172293543","html_url":"https://github.com/ESAPI/esapi-java-legacy/issues/329#issuecomment-172293543","issue_url":"https://api.github.com/repos/ESAPI/esapi-java-legacy/issues/329","id":172293543,"user":{"login":"kwwall","id":1959835,"avatar_url":"https://avatars.githubusercontent.com/u/1959835?v=3","gravatar_id":"","url":"https://api.github.com/users/kwwall","html_url":"https://github.com/kwwall","followers_url":"https://api.github.com/users/kwwall/followers","following_url":"https://api.github.com/users/kwwall/following{/other_user}","gists_url":"https://api.github.com/users/kwwall/gists{/gist_id}","starred_url":"https://api.github.com/users/kwwall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwwall/subscriptions","organizations_url":"https://api.github.com/users/kwwall/orgs","repos_url":"https://api.github.com/users/kwwall/repos","events_url":"https://api.github.com/users/kwwall/events{/privacy}","received_events_url":"https://api.github.com/users/kwwall/received_events","type":"User","site_admin":false},"created_at":"2016-01-17T05:35:34Z","updated_at":"2016-01-17T05:35:34Z","body":"@xeno6696 Matt, if you want to work on this, drop me a direct email to my\nGmail account (with a new subject so it get lost in all these other GitHub\nissue threads) and we can discuss a strategy.\n-kevin\n\nOn Thu, Dec 24, 2015 at 12:36 PM, xeno6696 <notifications@github.com> wrote:\n\n> @kwwall <https://github.com/kwwall>, I'm inclined to agree that this is a\n> bug, but since its threading and my experience with threading (in coding)\n> isn't deep, I'd like to coordinate with you as to what you think the\n> appropriate solution is. We could mark this as non-threadsafe but then also\n> include a threadsafe version. I have some experience writing multithreaded\n> tests to prove threading issues.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/ESAPI/esapi-java-legacy/issues/329#issuecomment-167140385>\n> .\n>\n\n\n\n-- \nBlog: http://off-the-wall-security.blogspot.com/\nNSA: All your crypto bit are belong to us.\n"}}