Skip to content

Qualify the LinkedHashMap size() call in removeEldestEntry (CodeQL java/subtle-inherited-call)#242

Open
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:features/codeql-subtle-inherited-call
Open

Qualify the LinkedHashMap size() call in removeEldestEntry (CodeQL java/subtle-inherited-call)#242
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:features/codeql-subtle-inherited-call

Conversation

@vharseko

@vharseko vharseko commented Jul 8, 2026

Copy link
Copy Markdown
Member

Summary

Resolves the java/subtle-inherited-call alert in AccessTokenValidationCache.

The cache is backed by an anonymous LinkedHashMap subclass whose
removeEldestEntry override calls an unqualified size():

protected boolean removeEldestEntry(Map.Entry<...> eldestEntry) {
    return size() > maxSize;
}

size() binds to LinkedHashMap.size() (the map's own size — the correct,
standard LRU idiom). But the enclosing AccessTokenValidationCache also declares
a size() method, so a reader could mistake the call for the enclosing one — and
that enclosing size() re-acquires the read lock, which would be wrong here since
removeEldestEntry runs inside put() while the write lock is already held.

Fix

Qualify the call as super.size(), making it explicit that the map's own
inherited size is intended. This is behaviour-preserving — the unqualified call
already resolved to LinkedHashMap.size().

Testing

mvn -o -pl commons/auth-filters/authz-filter/modules/oauth2-module compile — BUILD SUCCESS.

…va/subtle-inherited-call)

The anonymous LinkedHashMap that backs AccessTokenValidationCache overrides
removeEldestEntry and calls an unqualified size(). That resolves to
LinkedHashMap.size() (correct), but the enclosing AccessTokenValidationCache
also declares a size() method, so the call is easy to misread as the enclosing
one - which would re-acquire the read lock while put() already holds the write
lock.

Qualify the call as super.size() to make it explicit that it is the map's own
inherited size. Behaviour is unchanged: the unqualified call already bound to
LinkedHashMap.size().
@vharseko vharseko requested a review from maximthomas July 8, 2026 14:37
@vharseko vharseko added codeql CodeQL static-analysis findings refactoring Code cleanup / refactoring, no behavior change labels Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codeql CodeQL static-analysis findings refactoring Code cleanup / refactoring, no behavior change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants