[I] MavenProject.getArtifacts() publishes a half-built set under concurrent access [maven]

["slachiewicz (via GitHub)" <gi...@apache.org>]

slachiewicz opened a new issue, #13200:
URL: https://github.com/apache/maven/issues/13200

   ### Affected version
   
   3.9.x and master (same code on both).
   
   ### Bug description
   
   `MavenProject.getArtifacts()` initialises its set lazily and assigns the field before filling it:
   
   ```java
   artifacts = new LinkedHashSet<>(resolvedArtifacts.size() * 2);
   for (Artifact artifact : resolvedArtifacts) {
       if (artifactFilter.include(artifact)) {
           artifacts.add(artifact);
       }
   }
   ```
   
   ([maven-3.9.x MavenProject.java:675](https://github.com/apache/maven/blob/maven-3.9.x/maven-core/src/main/java/org/apache/maven/project/MavenProject.java#L675), [master MavenProject.java:897](https://github.com/apache/maven/blob/master/impl/maven-core/src/main/java/org/apache/maven/project/MavenProject.java#L897))
   
   A second thread calling `getArtifacts()` during the loop receives the half-built set and any iteration over it throws `ConcurrentModificationException` while the first thread keeps adding. The `MojoExecutor` project and aggregator locks keep mojo executions apart, so in a plain build the two callers should not overlap; the trace in apache/maven-plugin-tools#852 (`maven-plugin-plugin:descriptor` on a parallel build, `LinkedHashMap$LinkedHashIterator.nextNode` under `JavaAnnotationsMojoDescriptorExtractor.extendJavaProjectBuilder`) shows that something does overlap. The trigger there is not identified; the publication itself is unsafe regardless.
   
   Fill a local set and assign it once, so a concurrent reader sees either `null` handling or a complete set:
   
   ```java
   Set<Artifact> result = new LinkedHashSet<>(...);
   for (...) { ... result.add(artifact); }
   artifacts = result;
   ```
   
   The same pattern exists in `getArtifactMap()` / `getDependencyArtifacts()` and is worth the same treatment.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] MavenProject.getArtifacts() publishes a half-built set under concurrent access [maven]

["gnodet (via GitHub)" <gi...@apache.org>]

gnodet closed issue #13200: MavenProject.getArtifacts() publishes a half-built set under concurrent access
URL: https://github.com/apache/maven/issues/13200


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org