Query module TOCTOURace

name
Time-of-check time-of-use race condition
description
Using a resource after an unsynchronized state check can lead to a race condition, if the state may be changed between the check and use.
kind
problem
problem.severity
warning
precision
medium
id
java/toctou-race-condition
tags
security external/cwe/cwe-367

Imports

Concurrency
Guards
java

Provides all default Java QL imports.

Predicates

alwaysLocked

Holds if all accesses to v (outside of initializers) are locked in the same way.

commonSynchronization

Holds if e1 and e2 appear within a synchronized block on monitor.

probablyNeverEscapes

Holds if the value of v probably never escapes the local scope.

synchCallOn

Holds if m is a call to a synchronized method on receiver.

Classes

PossiblyConcurrentCallable

A callable that might be used concurrently. This is a heuristic to avoid flagging non-concurrent usage of classes that try to be concurrency-safe (e.g. a lot of the Java collections).