[jira] Created: (XALANJ-2463) XPathExpressionImpl is not thread safe (unsafe use of static DocumentBuilder object instance)

["PJ Fanning (JIRA)" <xa...@xml.apache.org>]

XPathExpressionImpl is not thread safe (unsafe use of static DocumentBuilder object instance)
---------------------------------------------------------------------------------------------

                 Key: XALANJ-2463
                 URL: https://issues.apache.org/jira/browse/XALANJ-2463
             Project: XalanJ2
          Issue Type: Bug
      Security Level: No security risk; visible to anyone (Ordinary problems in Xalan projects.  Anybody can view the issue.)
          Components: XPath
    Affects Versions: 2.7.1
            Reporter: PJ Fanning


XPathExpressionImpl is not thread safe (unsafe use of static DocumentBuilder object instance).

See code snippet from XPathExpressionImpl below (note the use of the static db member and the fact that evaluate could be called for different XPathExpressionImpl  instances simultaneously):

    static DocumentBuilderFactory dbf = null;
    static DocumentBuilder db = null;
    static Document d = null;

    public Object evaluate(InputSource source, QName returnType)
        throws XPathExpressionException {
        if ( ( source == null ) || ( returnType == null ) ) {
            String fmsg = XSLMessages.createXPATHMessage( 
                    XPATHErrorResources.ER_SOURCE_RETURN_TYPE_CANNOT_BE_NULL,
                    null );
            throw new NullPointerException ( fmsg );
        }
        // Checking if requested returnType is supported. returnType need to be
        // defined in XPathConstants 
        if ( !isSupported ( returnType ) ) {
            String fmsg = XSLMessages.createXPATHMessage( 
                    XPATHErrorResources.ER_UNSUPPORTED_RETURN_TYPE,
                    new Object[] { returnType.toString() } );
            throw new IllegalArgumentException ( fmsg );
        }
        try {
            if ( dbf == null ) {
                dbf = DocumentBuilderFactory.newInstance();
                dbf.setNamespaceAware( true );
                dbf.setValidating( false );
            }
            db = dbf.newDocumentBuilder();
            Document document = db.parse( source );
            return eval(  document, returnType );
        } catch ( Exception e ) {
            throw new XPathExpressionException ( e );
        }
    }


Exception looks like:
Caused by: javax.xml.xpath.XPathExpressionException
	at org.apache.xpath.jaxp.XPathExpressionImpl.evaluate(XPathExpressionImpl.java:298)
	at org.apache.xpath.jaxp.XPathExpressionImpl.evaluate(XPathExpressionImpl.java:325)
	at test.TestXalanXPath$Runner.run(TestXalanXPath.java:49)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)
Caused by: org.xml.sax.SAXException: FWK005 parse may not be called while parsing.
	at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
	at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
	at org.apache.xpath.jaxp.XPathExpressionImpl.evaluate(XPathExpressionImpl.java:295)
	... 5 more

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


---------------------------------------------------------------------
To unsubscribe, e-mail: xalan-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xalan-dev-help@xml.apache.org