CWE-383: J2EE Bad Practices: Direct Use of Threads
J2EE Bad Practices: Direct Use of Threads
Weakness ID: 383 (Weakness Variant)
Status: Draft
Description
Description Summary
Thread management in a Web application is forbidden in some
circumstances and is always highly error prone.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
Java
Demonstrative Examples
Example 1
In the following example, a new Thread object is created and invoked
directly from within the body of a doGet() method in a Java
servlet.
(Bad Code)
Java
public void doGet(HttpServletRequest request, HttpServletResponse
response) throws ServletException, IOException {
// Perform servlet tasks.
...
// Create a new thread to handle background processing.
Runnable r = new Runnable() {
public void run() {
// Process and store request statistics.
...
}
};
new Thread(r).start();
}
Potential Mitigations
Phase
Description
For EJB, use framework approaches for parallel execution, instead of
using threads.
Other Notes
Thread management in a web application is forbidden by the J2EE standard
in some circumstances and is always highly error prone. Managing threads is
difficult and is likely to interfere in unpredictable ways with the behavior
of the application container. Even without interfering with the container,
thread management usually leads to bugs that are hard to detect and diagnose
like deadlock, race conditions, and other synchronization errors.
Description
