Migrated from https://git2.unturf.com/engineering/java-topology.git
russell@unturf.com
8b04e01458
First MOAD-0003 (Leaked Context) flagship this session. Surfaced via scanner enhancement: commit 1f48798 (Java ThreadLocal-scoped .set fix) dropped wildfly M3 noise from 4840 -> 37, exposing this real defect. Defect: ElytronSecurityIntegration.java:38 declares private final ThreadLocal<SecurityContext> securityContext = new ThreadLocal<>(); with setSecurityContext() calling .set(context) and ZERO corresponding .remove() / .set(null) anywhere in the WildFly codebase (verified by grep -rn). JCA WorkManager reuses pool threads across Work items from different security principals; a leftover SecurityContext from prior Work is visible to any subsequent Work that reads getSecurityContext() before installing its own — which WildflyWorkWrapper.runWork() does exactly to decide whether to use Elytron-runWork or super.runWork(). Fix: 2-file surgical patch (no SPI change): 1. setSecurityContext(null) now calls .remove() (clear ThreadLocal, prevent classloader retention) 2. WildflyWorkWrapper.runWork() wraps body in try/finally that calls setSecurityContext(null) after the Work item completes This is the inverse pipeline from CWE-407 flagships: scanner improved its signal-to-noise so triage could find what raw scanning could not have ranked. |
||
|---|---|---|
| .github | ||
| .jcheck | ||
| bin | ||
| defects | ||
| doc | ||
| docs | ||
| make | ||
| scanner | ||
| src | ||
| test | ||
| tests | ||
| tools | ||
| whitepaper | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| ADDITIONAL_LICENSE_INFO | ||
| ASSEMBLY_EXCEPTION | ||
| CLAUDE.md | ||
| compile-unit-tests.sh | ||
| configure | ||
| CONTRIBUTING.md | ||
| GNUmakefile | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| SCAN-TODO.md | ||
| SECURITY.md | ||
| UNDF-REGISTRY.json | ||
Welcome to the JDK!
For build instructions please see the online documentation, or either of these files:
- doc/building.html (html version)
- doc/building.md (markdown version)
See https://openjdk.org/ for more information about the OpenJDK Community and the JDK and see https://bugs.openjdk.org for JDK issue tracking.