[#13861] - Concurrent use of SimpleDateFormat

In file https://github.com/TIBCOSoftware/jasperreports-server-ce/blob/master/jas..., an instance of SimpleDateFormat is used for a static field. This class is instantiated in https://github.com/TIBCOSoftware/jasperreports-server-ce/blob/e65ce85a5d... from different threads concurrently for each http request. All these requests therefore share the same instance of SimpleDateFormat which is not thread-safe (https://stackoverflow.com/questions/18383251/strange-arrayindexoutofboun...).

The following stack trace ensues :
java.lang.ArrayIndexOutOfBoundsException: -2147483648
at java.util.Calendar.getDisplayName(Calendar.java:2114)
at java.text.SimpleDateFormat.subFormat(SimpleDateFormat.java:1125)
at java.text.SimpleDateFormat.format(SimpleDateFormat.java:966)
at java.text.SimpleDateFormat.format(SimpleDateFormat.java:936)
at java.text.DateFormat.format(DateFormat.java:345)
at com.jaspersoft.jasperserver.api.metadata.user.service.impl.HttpOnlyResponseWrapper.addCookie(HttpOnlyResponseWrapper.java:64)
at com.jaspersoft.jasperserver.war.UserPreferencesFilter.doFilter(UserPreferencesFilter.java:122)
[...]

The server then stops processing any further requests.

A workaround is to avoid using the SimpleDateFormat class by setting cookieAge for the UserPreferencesFilter instance in applicationContext-security-web.xml to "-1" which results in cookies being issued without a date, making them session cookies :
<beans>
[...]
<bean id="userPreferencesFilter" class="com.jaspersoft.jasperserver.war.UserPreferencesFilter">
<property name="cookieAge">
<value type="int">-1</value>
</property>
[...]
</bean>
[...]
</beans>