[GitHub] [skywalking] muse-dev[bot] commented on a change in pull request #7071: CVE: upgrade snakeyaml to prevent billion laughs attack in dynamic configuration

[GitBox <gi...@apache.org>]

muse-dev[bot] commented on a change in pull request #7071:
URL: https://github.com/apache/skywalking/pull/7071#discussion_r645949567



##########
File path: oap-server/server-configuration/configuration-api/src/main/java/org/apache/skywalking/oap/server/configuration/api/ConfigWatcherRegister.java
##########
@@ -64,15 +64,14 @@ synchronized public void registerConfigChangeWatcher(ConfigChangeWatcher watcher
     public void start() {
         isStarted = true;
 
-        configSync();
         LOGGER.info("Current configurations after the bootstrap sync." + LINE_SEPARATOR + register.toString());

Review comment:
       *THREAD_SAFETY_VIOLATION:*  Read/Write race. Non-private method `ConfigWatcherRegister.start()` indirectly reads without synchronization from container `this.register.register` via call to `Map.forEach(...)`. Potentially races with write in method `ConfigWatcherRegister.registerConfigChangeWatcher(...)`.
    Reporting because another access to the same memory occurs on a background thread, although this access may not.
   (at-me [in a reply](https://docs.muse.dev/docs/talk-to-muse/) with `help` or `ignore`)




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org