Uncontrolled thread resource consumption from local input source

The Thread.sleep method is used to pause the execution of current thread for specified time. When the sleep time is user-controlled, especially in the web application context, it can be abused to cause all of a server's threads to sleep, leading to denial of service.

Recommendation

To guard against this attack, consider specifying an upper range of allowed sleep time or adopting the producer/consumer design pattern with Object.wait method to avoid performance problems or even resource exhaustion. For more information, refer to the concurrency tutorial of Oracle listed below or java/ql/src/Likely Bugs/Concurrency queries of CodeQL.

Example

The following example shows a bad situation and a good situation respectively. In the bad situation, a thread sleep time comes directly from user input. In the good situation, an upper range check on the maximum sleep time allowed is enforced.

class SleepTest {
	public void test(int userSuppliedWaitTime) throws Exception {
		// BAD: no boundary check on wait time
		Thread.sleep(userSuppliedWaitTime);

		// GOOD: enforce an upper limit on wait time
		if (userSuppliedWaitTime > 0 && userSuppliedWaitTime < 5000) {
			Thread.sleep(userSuppliedWaitTime);
		}
	}
}

References

• Snyk: Denial of Service (DoS) in com.googlecode.gwtupload:gwtupload.
• gwtupload: [Fix DOS issue] Updating the AbstractUploadListener.java file.
• The blog of a gypsy engineer: CVE-2019-17555: DoS via Retry-After header in Apache Olingo.
• Oracle: The Java Concurrency Tutorials
• Common Weakness Enumeration: CWE-400.