[JEXL-325] Potential race-condition in NumberParser.toString()

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.1
• Fix Version/s: 3.2
• Assignee: Henri Biestro
• Reporter: Dmitri Blinov
• Created: 28/Jan/20 08:28
• Updated: 07/Jun/21 13:14
• Resolved: 28/Jan/20 15:44

Description

To format BigDecimal values the current implementation uses static instance of DecimalFormat class without synchronization, whereas according to Java doc Decimal formats are not synchronized and must be synchronized externally. There is also a dead branch on BigDecimal check. The suggestion is to change NumberParser.to String() to something as follows:

    @Override
    public String toString() {
        if (literal == null || clazz == null || Double.isNaN(literal.doubleValue())) {
            return "NaN";
        }
        if (BigDecimal.class.equals(clazz)) {
            synchronized (BIGDF) {
                return BIGDF.format(literal);
            }
        }
        StringBuilder strb = new StringBuilder(literal.toString());
        if (Float.class.equals(clazz)) {
            strb.append('f');
        } else if (Double.class.equals(clazz)) {
            strb.append('d');
        } else if (BigInteger.class.equals(clazz)) {
            strb.append('h');
        } else if (Long.class.equals(clazz)) {
            strb.append('l');
        }
        return strb.toString();
    }