[I] [maven-4.0.x] DefaultModelBuilder: thread-unsafe HashSet inside ConcurrentHashMap [maven]

["elharo (via GitHub)" <gi...@apache.org>]

elharo opened a new issue, #12597:
URL: https://github.com/apache/maven/issues/12597

   # DefaultModelBuilder: Thread-unsafe HashSet inside ConcurrentHashMap
   
   **Found in:** maven-4.0.x branch
   **File:** `impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java` (lines 454-457)
   **Severity:** High
   
   ## Description
   
   `mappedSources` is a `ConcurrentHashMap<GAKey, Set<ModelSource>>`. While `computeIfAbsent` is atomic for the map, the returned `HashSet` values are shared across threads and are NOT thread-safe:
   
   ```java
   public void putSource(String groupId, String artifactId, ModelSource source) {
       mappedSources
               .computeIfAbsent(new GAKey(groupId, artifactId), k -> new HashSet<>())
               .add(source);
   }
   ```
   
   If multiple threads concurrently add sources for the same `GAKey`, the internal structure of the `HashSet` can become corrupted (lost updates, infinite loops during iteration, etc.). This is exercisable during parallel reactor builds where `loadFilePom` calls `putSource` from within executor tasks running concurrently.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [maven-4.0.x] DefaultModelBuilder: thread-unsafe HashSet inside ConcurrentHashMap [maven]

["elharo (via GitHub)" <gi...@apache.org>]

elharo closed issue #12597: [maven-4.0.x] DefaultModelBuilder: thread-unsafe HashSet inside ConcurrentHashMap
URL: https://github.com/apache/maven/issues/12597


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [maven-4.0.x] DefaultModelBuilder: thread-unsafe HashSet inside ConcurrentHashMap [maven]

["goutamadwant (via GitHub)" <gi...@apache.org>]

goutamadwant commented on issue #12597:
URL: https://github.com/apache/maven/issues/12597#issuecomment-5336386968

   @elharo I prepared a fix #12766 that stores mapped sources in a concurrent key set. Pls review and let me know if there are any suggestions or comments. thanks! 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org