[java-opensaml] branch maint-4 updated: OSJ-365 - BasicX509Credential has race condition around cert access

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-4
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=3a056b0588c0bac3c4a884e74681cf8a4c181b62

The following commit(s) were added to refs/heads/maint-4 by this push:
     new 3a056b058 OSJ-365 - BasicX509Credential has race condition around cert access
3a056b058 is described below

commit 3a056b0588c0bac3c4a884e74681cf8a4c181b62
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 14 11:43:52 2022 -0500

    OSJ-365 - BasicX509Credential has race condition around cert access
    
    https://shibboleth.atlassian.net/browse/OSJ-365
---
 .../opensaml/security/x509/BasicX509Credential.java | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
index bb1829d1e..d6586dbb6 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
@@ -130,13 +130,15 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull public Collection<X509Certificate> getEntityCertificateChain() {
-        if (entityCertChain == null) {
-            final LazySet<X509Certificate> constructedChain = new LazySet<>();
-            constructedChain.add(entityCert);
-            return constructedChain;
+    @Nonnull @NonnullElements public Collection<X509Certificate> getEntityCertificateChain() {
+        synchronized(entityCertChain) {
+            if (entityCertChain == null) {
+                final LazySet<X509Certificate> constructedChain = new LazySet<>();
+                constructedChain.add(entityCert);
+                return constructedChain;
+            }
+            return entityCertChain;
         }
-        return entityCertChain;
     }
 
     /**
@@ -148,7 +150,10 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
     public void setEntityCertificateChain(@Nonnull final Collection<X509Certificate> newCertificateChain) {
         Constraint.isNotNull(newCertificateChain, "Certificate chain collection cannot be null");
         Constraint.isNotEmpty(newCertificateChain, "Certificate chain collection cannot be empty");
-        entityCertChain = new ArrayList<>(newCertificateChain);
+        
+        synchronized(entityCertChain) {
+            entityCertChain = new ArrayList<>(newCertificateChain);
+        }
     }
     
     /**
@@ -171,4 +176,4 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
         throw new UnsupportedOperationException("An X509Credential may not contain a secret key");
     }
 
-}
\ No newline at end of file
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.