[#13861] - Concurrent use of SimpleDateFormat

Category:
Bug report
Priority:
Normal
Status:
New
Project: Severity:
Minor
Resolution:
Open
Component: Reproducibility:
Random
Assigned to:
0

In file https://github.com/TIBCOSoftware/jasperreports-server-ce/blob/master/jas..., an instance of SimpleDateFormat is used for a static field. This class is instantiated in https://github.com/TIBCOSoftware/jasperreports-server-ce/blob/e65ce85a5d... from different threads concurrently for each http request. All these requests therefore share the same instance of SimpleDateFormat which is not thread-safe (https://stackoverflow.com/questions/18383251/strange-arrayindexoutofboun...).

The following stack trace ensues :
java.lang.ArrayIndexOutOfBoundsException: -2147483648
at java.util.Calendar.getDisplayName(Calendar.java:2114)
at java.text.SimpleDateFormat.subFormat(SimpleDateFormat.java:1125)
at java.text.SimpleDateFormat.format(SimpleDateFormat.java:966)
at java.text.SimpleDateFormat.format(SimpleDateFormat.java:936)
at java.text.DateFormat.format(DateFormat.java:345)
at com.jaspersoft.jasperserver.api.metadata.user.service.impl.HttpOnlyResponseWrapper.addCookie(HttpOnlyResponseWrapper.java:64)
at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferencesFilter.java:122)
[...]

The server then stops processing any further requests.

A workaround is to avoid using the SimpleDateFormat class by setting cookieAge for the UserPreferencesFilter instance in applicationContext-security-web.xml to "-1" which results in cookies being issued without a date, making them session cookies :
<beans>
[...]
<bean id="userPreferencesFilter" class="com.jaspersoft.jasperserver.war.UserPreferencesFilter">
<property name="cookieAge">
<value type="int">-1</value>
</property>
[...]
</bean>
[...]
</beans>

v7.8.0
JasperReports Server
julien.hemono's picture
Joined: Oct 29 2021 - 9:36am
Last seen: 1 month 1 day ago
Feedback