Qualify the LinkedHashMap size() call in removeEldestEntry (CodeQL java/subtle-inherited-call)#242
Open
vharseko wants to merge 1 commit into
Conversation
…va/subtle-inherited-call) The anonymous LinkedHashMap that backs AccessTokenValidationCache overrides removeEldestEntry and calls an unqualified size(). That resolves to LinkedHashMap.size() (correct), but the enclosing AccessTokenValidationCache also declares a size() method, so the call is easy to misread as the enclosing one - which would re-acquire the read lock while put() already holds the write lock. Qualify the call as super.size() to make it explicit that it is the map's own inherited size. Behaviour is unchanged: the unqualified call already bound to LinkedHashMap.size().
maximthomas
approved these changes
Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the
java/subtle-inherited-callalert inAccessTokenValidationCache.The cache is backed by an anonymous
LinkedHashMapsubclass whoseremoveEldestEntryoverride calls an unqualifiedsize():size()binds toLinkedHashMap.size()(the map's own size — the correct,standard LRU idiom). But the enclosing
AccessTokenValidationCachealso declaresa
size()method, so a reader could mistake the call for the enclosing one — andthat enclosing
size()re-acquires the read lock, which would be wrong here sinceremoveEldestEntryruns insideput()while the write lock is already held.Fix
Qualify the call as
super.size(), making it explicit that the map's owninherited size is intended. This is behaviour-preserving — the unqualified call
already resolved to
LinkedHashMap.size().Testing
mvn -o -pl commons/auth-filters/authz-filter/modules/oauth2-module compile— BUILD SUCCESS.