PasswordProvider abstraction could be abused for races
- Dominant language
- Java
- Stars
- 14.1k
- Forks
- 3.8k
- Avg merge
- 2d 31m
- Merged PRs (30d)
- 209
Description
Some classes that have multiple `PasswordProvider` fields could inherently be subject to races:
- `SSLClientConfig`
- `MySQLConnectorConfig`
- `ClientSSLContextBuilder`
- `TLSServerConfig`
- `BasicHTTPAuthenticator`
- `BasicAuthDBConfig`
- `AWSCredentialsConfig`
Contributor guide
Research direction
Start by reading PasswordProvider and inspecting the listed classes: SSLClientConfig, MySQLConnectorConfig, ClientSSLContextBuilder, TLSServerConfig, BasicHTTPAuthenticator, BasicAuthDBConfig, and AWSCredentialsConfig. Trace how their multiple PasswordProvider fields may be accessed concurrently. Done means the race risk is resolved consistently across the affected classes and the relevant concurrent behavior is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100