[HTTPCLIENT-1915] httpClient.execute not thread-safe with redirectLocations

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 4.5.2
• Component/s: HttpClient (classic)
• Environment: docker tomcat:7.0.72 (JRE 7)
• Assignee: Unassigned
• Reporter: Nicolas Toublanc
• Created: 16/Apr/18 08:55
• Updated: 16/Apr/18 15:21
• Resolved: 16/Apr/18 15:21

Description

Sometimes, with 2 simultaneous httpClient.execute, I got the following error:

java.util.ConcurrentModificationException: null at java.util.AbstractList$Itr.remove(AbstractList.java:380) at java.util.AbstractList.removeRange(AbstractList.java:571) at java.util.AbstractList.clear(AbstractList.java:234) at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:102) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) at 

The cause is redirectLocations collection (in RedirectExec.execute) not being thread-safe:**

  final List<URI> redirectLocations = context.getRedirectLocations();
        if (redirectLocations != null) {
            redirectLocations.clear();
        }

I can't figure where this collection is created.