[java-opensaml] branch main updated: OSJ-365 - BasicX509Credential has race condition around cert access

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=1167856016ace463aad678fd4e775e25f8efe55f

The following commit(s) were added to refs/heads/main by this push:
     new 116785601 OSJ-365 - BasicX509Credential has race condition around cert access
116785601 is described below

commit 1167856016ace463aad678fd4e775e25f8efe55f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 14 11:43:52 2022 -0500

    OSJ-365 - BasicX509Credential has race condition around cert access
    
    https://shibboleth.atlassian.net/browse/OSJ-365
---
 .../org/opensaml/security/x509/BasicX509Credential.java | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
index f50fe01d8..393624260 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
@@ -131,12 +131,14 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
     /** {@inheritDoc} */
     @Override
     @Nonnull @NonnullElements public Collection<X509Certificate> getEntityCertificateChain() {
-        if (entityCertChain == null) {
-            final LazySet<X509Certificate> constructedChain = new LazySet<>();
-            constructedChain.add(entityCert);
-            return constructedChain;
+        synchronized(entityCertChain) {
+            if (entityCertChain == null) {
+                final LazySet<X509Certificate> constructedChain = new LazySet<>();
+                constructedChain.add(entityCert);
+                return constructedChain;
+            }
+            return entityCertChain;
         }
-        return entityCertChain;
     }
 
     /**
@@ -148,7 +150,10 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
     public void setEntityCertificateChain(@Nonnull @NotEmpty @NonnullElements final Collection<X509Certificate> newCertificateChain) {
         Constraint.isNotNull(newCertificateChain, "Certificate chain collection cannot be null");
         Constraint.isNotEmpty(newCertificateChain, "Certificate chain collection cannot be empty");
-        entityCertChain = new ArrayList<>(newCertificateChain);
+        
+        synchronized(entityCertChain) {
+            entityCertChain = new ArrayList<>(newCertificateChain);
+        }
     }
     
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.