[XALANJ-2463] XPathExpressionImpl is not thread safe (unsafe use of static DocumentBuilder object instance)

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.7.1
• Component/s: XPath
• Security Level: No security risk; visible to anyone (Ordinary problems in Xalan projects. Anybody can view the issue.)
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 03/Nov/08 18:26
• Updated: 03/Nov/08 18:40

Description

XPathExpressionImpl is not thread safe (unsafe use of static DocumentBuilder object instance).

See code snippet from XPathExpressionImpl below (note the use of the static db member and the fact that evaluate could be called for different XPathExpressionImpl instances simultaneously):

static DocumentBuilderFactory dbf = null;
static DocumentBuilder db = null;
static Document d = null;

public Object evaluate(InputSource source, QName returnType)
throws XPathExpressionException {
if ( ( source == null ) || ( returnType == null ) )

{ String fmsg = XSLMessages.createXPATHMessage( XPATHErrorResources.ER_SOURCE_RETURN_TYPE_CANNOT_BE_NULL, null ); throw new NullPointerException ( fmsg ); }

// Checking if requested returnType is supported. returnType need to be
// defined in XPathConstants
if ( !isSupported ( returnType ) ) {
String fmsg = XSLMessages.createXPATHMessage(
XPATHErrorResources.ER_UNSUPPORTED_RETURN_TYPE,
new Object[]

{ returnType.toString() }

);
throw new IllegalArgumentException ( fmsg );
}
try {
if ( dbf == null )

{ dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware( true ); dbf.setValidating( false ); }

db = dbf.newDocumentBuilder();
Document document = db.parse( source );
return eval( document, returnType );
} catch ( Exception e )

{ throw new XPathExpressionException ( e ); }

}

Exception looks like:
Caused by: javax.xml.xpath.XPathExpressionException
at org.apache.xpath.jaxp.XPathExpressionImpl.evaluate(XPathExpressionImpl.java:298)
at org.apache.xpath.jaxp.XPathExpressionImpl.evaluate(XPathExpressionImpl.java:325)
at test.TestXalanXPath$Runner.run(TestXalanXPath.java:49)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: org.xml.sax.SAXException: FWK005 parse may not be called while parsing.
at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
at org.apache.xpath.jaxp.XPathExpressionImpl.evaluate(XPathExpressionImpl.java:295)
... 5 more