OWASP / OWASP/SecurityShepherd

Review/dismiss CodeQL double-checked-locking flag on MongoDatabase.baseMongoClient

Open
#858 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.5k
Forks
515
Avg merge
3h 46m
Merged PRs (30d)
1

Description

Summary

The code-quality bot (CodeQL on #816) flags a race condition in double-checked locking for the singleton initialization of baseMongoClient in src/main/java/dbProcs/MongoDatabase.java.

The assignment baseMongoClient = createMongoClient(null); (inside synchronized (lock) at ~line 189) is reported as potentially visible to other threads before subsequent statements complete.

Assessment (please confirm before acting)

This may be low severity / a false positive as currently written:

  • baseMongoClient is declared volatile (MongoDatabase.java:54), which gives the double-checked-locking idiom its required safe-publication guarantee under the Java Memory Model (JDK 5+).
  • The assignment happens inside synchronized (lock) after createMongoClient(null) returns a fully-constructed client, so no partially-initialized object is published.

The classic DCL bug requires a non-volatile field; with volatile the pattern is correct. The bot's analyzer may not be accounting for the volatile modifier.

Action

  • Confirm whether the bot finding is a true positive given the volatile field. If it is a false positive, dismiss the alert (and optionally add a brief code comment explaining the safe-publication guarantee).
  • If there's a genuine ordering concern the analysis caught (e.g. other reads of related non-volatile state), address it.

Context

Surfaced while reviewing the code-quality bot output on #816. Out of scope for the connection-pooling / try-with-resources work (#846, #855, #857) — filed as a standalone follow-up. Not a blocker for #816.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with src/main/java/dbProcs/MongoDatabase.java, especially the volatile baseMongoClient declaration and the synchronized initialization near line 189. Review the CodeQL finding from #816 against the Java Memory Model and check whether related reads or state are involved. Done means confirming the finding’s status and either dismissing it with an explanation or addressing the demonstrated ordering concern.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, mongodb
Domain
backend, databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.