CWE-383: J2EE Bad Practices: Direct Use of Threads
J2EE Bad Practices: Direct Use of Threads
Weakness ID: 383 (Weakness Variant)
Status: Draft
Description
Description Summary
Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
Extended Description
Thread management in a web application is forbidden by the J2EE standard in some circumstances and is always highly error prone. Managing threads is difficult and is likely to interfere in unpredictable ways with the behavior of the application container. Even without interfering with the container, thread management usually leads to bugs that are hard to detect and diagnose like deadlock, race conditions, and other synchronization errors.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Other
Technical Impact: Quality degradation
Demonstrative Examples
Example 1
In the following example, a new Thread object is created and invoked
directly from within the body of a doGet() method in a Java
servlet.
(Bad Code)
Example
Language: Java
public void doGet(HttpServletRequest request, HttpServletResponse
response) throws ServletException, IOException {
// Perform servlet tasks.
...
// Create a new thread to handle background
processing.
Runnable r = new Runnable() {
public void run() {
// Process and store request statistics.
...
}
};
new Thread(r).start();
}
Potential Mitigations
For EJB, use framework approaches for parallel execution, instead of
using threads.
Description
