This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/commons-configuration.git
commit cd4a33f9a1c786a1f7159639449ca24329ba2cbe Author: Gary Gregory <[email protected]> AuthorDate: Sat Aug 22 11:58:17 2026 -0400 Fix SpotBugs USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION in XMLPropertyListConfiguration. [ERROR] Medium: The lock object org.apache.commons.configuration2.plist.XMLPropertyListConfiguration$PListNodeBuilder.FORMAT used in method org.apache.commons.configuration2.plist.XMLPropertyListConfiguration$PListNodeBuilder.addDateValue(String) is exposed to untrusted code outside of class org.apache.commons.configuration2.plist.XMLPropertyListConfiguration$PListNodeBuilder, through updating or returning its value from static org.apache.commons.configuration2.plist.XMLPropertyListConfiguration$PListNodeBuilder.access$2()Ljava/text/DateFormat;. [org.apache.commons.configuration2.plist.XMLPropertyListConfiguration$PListNodeBuilder] At XMLPropertyListConfiguration.java:[lines 222-236] USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION --- src/changes/changes.xml | 1 + .../plist/XMLPropertyListConfiguration.java | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 1eb77ed1e..9b1273544 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -31,6 +31,7 @@ <action type="fix" dev="ggregory" due-to="Gary Gregory">Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in FileBasedConfigurationBuilder.</action> <action type="fix" dev="ggregory" due-to="Gary Gregory">Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in MultiFileConfigurationBuilder.</action> <action type="fix" dev="ggregory" due-to="Gary Gregory">Fix SpotBugs USO_UNSAFE_METHOD_SYNCHRONIZATION in ReloadingCombinedConfigurationBuilder.</action> + <action type="fix" dev="ggregory" due-to="Gary Gregory">Fix SpotBugs USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION in XMLPropertyListConfiguration.</action> <!-- ADD --> <!-- UPDATE --> <action type="update" dev="ggregory" due-to="Gary Gregory">Bump org.apache.commons:commons-parent from 100 to 103.</action> diff --git a/src/main/java/org/apache/commons/configuration2/plist/XMLPropertyListConfiguration.java b/src/main/java/org/apache/commons/configuration2/plist/XMLPropertyListConfiguration.java index 5e92fe563..04b415cca 100644 --- a/src/main/java/org/apache/commons/configuration2/plist/XMLPropertyListConfiguration.java +++ b/src/main/java/org/apache/commons/configuration2/plist/XMLPropertyListConfiguration.java @@ -181,6 +181,18 @@ public class XMLPropertyListConfiguration extends BaseHierarchicalConfiguration */ private static final DateFormat GNUSTEP_FORMAT = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z"); + /** + * Formats a date∂. + * + * @param date The date to format. + * @return The formatted date string. + */ + static String formatDate(final Date date) { + synchronized (FORMAT) { + return FORMAT.format(date); + } + } + /** A collection with child builders of this builder. */ private final Collection<PListNodeBuilder> childBuilders = new LinkedList<>(); @@ -592,9 +604,7 @@ public class XMLPropertyListConfiguration extends BaseHierarchicalConfiguration final String padding = StringUtils.repeat(" ", indentLevel * INDENT_SIZE); if (value instanceof Date) { - synchronized (PListNodeBuilder.FORMAT) { - out.println(padding + "<date>" + PListNodeBuilder.FORMAT.format((Date) value) + "</date>"); - } + out.println(padding + "<date>" + PListNodeBuilder.formatDate((Date) value) + "</date>"); } else if (value instanceof Calendar) { printValue(out, indentLevel, ((Calendar) value).getTime()); } else if (value instanceof Number) {
