Hi @Mohamad Fadel (Community Member)​,

Veracode will flag CWE ID 366 if it can detect that there is a possibility for a race condition. Mostly this is flagged when a member variable is used in a Java HttpServlet.

You can use the Java 'synchronized' keyword ( https://docs.oracle.com/javase/tutorial/essential/concurrency/syncmeth.html ) to resolve this but I would caution you that this is typically not the best solution.

Say for example you have the following code:

public final class HelloWorldServlet extends HttpServlet {

private String userName;

public void doGet(HttpServletRequest request, HttpServletResponse response) {

this.userName = request.getParameter("username");

verifyLogin();

registerLoginRequest();

redirectUser(response);

}}

The problem is that the userName variable is shared across all threads that handle requests. So if you login and the username is set to "mohamad" but while the application server is still verifying your login I log in as well with "boy". Suddenly 'userName' for both our threads will be set to "boy". So the application may log you in as me!

Now you can fix this by using synchronized like so:

public final class HelloWorldServlet extends HttpServlet {

private String userName;

public void doGet(HttpServletRequest request, HttpServletResponse response) {

synchronized (this) {

this.userName = request.getParameter("username");

verifyLogin();

registerLoginRequest();

redirectUser(response);

}}}

The downside for this is that you would need to wrap all usage of 'userName' in synchronized, which is easily forgotten, and you would be blocking me from logging in while you are logging in. Effectively making your application single threaded, which will be very bad for performance!

It's often better to either pass the variable along to the method or use a separate object.

So either:

public final class HelloWorldServlet extends HttpServlet {

public void doGet(HttpServletRequest request, HttpServletResponse response) {

String userName = request.getParameter("username");

verifyLogin(userName);

registerLoginRequest(userName);

redirectUser(userName, response);

}}}

Or:

public final class HelloWorldServlet extends HttpServlet {

public void doGet(HttpServletRequest request, HttpServletResponse response) {

LoginHandler handler = new LoginHandler();

handler.processLogin(request, response);

}}

If the member variable is not request / user specific you may also consider using the "init" method: https://stackoverflow.com/a/51399803/4512

You can read more on servlets here: https://stackoverflow.com/a/3106909/4512 .

Thank you,

Boy Baukema, Veracode Application Security Consultant

Thanks @Boy, Security Consultant (Veracode)​ for sharing the insights!

Hi @Mohamad Fadel (Community Member)​ , I hope you find what @Boy, Security Consultant (Veracode)​ suggested helpful in understand what's causing CWE ID 366 and what could be done to address the issue. If you are ready to close this question, we'd appreciate if you could select his answer as the best answer, by clicking on "Select as Best" at the bottom of his post. This will help other Community members facing similar challenges find the solution faster. Otherwise, if you have additional questions, feel free to comment below to let us know. Thank you so much for visiting the Veracode Community. I hope you have a great week ahead!