Skip to content

[type: bug] Fix thread safety issue with shared static CONTEXT in ExpressionGenerator (#6880) - #6995

Open
zhang-arvin wants to merge 1 commit into
apache:masterfrom
zhang-arvin:fix/6880-thread-safety-context
Open

[type: bug] Fix thread safety issue with shared static CONTEXT in ExpressionGenerator (#6880)#6995
zhang-arvin wants to merge 1 commit into
apache:masterfrom
zhang-arvin:fix/6880-thread-safety-context

Conversation

@zhang-arvin

Copy link
Copy Markdown
Contributor

Closes #6880

…ressionGenerator (apache#6880)

Signed-off-by: zhang-arvin <arvin.zhang@htx-inc.com>

@Aias00 Aias00 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

Correct concurrency fix for the mock expression generators.

Root cause (confirmed)

ExpressionGenerator (and StandardExpressionGenerator) held a private static final EvaluationContext CONTEXT that was mutated per request via CONTEXT.setVariable("req", mockRequest) before getValue(CONTEXT). Because the context was shared and mutable, concurrent mock evaluations raced on the req variable (and any other context state), producing cross-request interference or inconsistent results.

What the fix does right

  • Replacing the shared static with a fresh initContext() per doGenerate call eliminates the shared mutable state — each invocation gets its own EvaluationContext.
  • The static SpelExpressionParser PARSER remains shared, which is safe: SpelExpressionParser and the parsed Expression objects are documented thread-safe, so the parser was never the problem — only the context.
  • Verified initContext() returns a new EvaluationContext each call, and no other references to the removed static CONTEXT remain in either ExpressionGenerator or StandardExpressionGenerator.

Verdict

Approve. No blocking issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] SignPluginDataHandler and AbstractCryptorPluginDataHandler guard removeRule on ruleData.getHandle() — leaking stale rule-handle cache entries

2 participants