During xSocket integration testing, I developed one sample application, based on NonBlockingConnection, whose client send a text message, followed by another client sending another, to the server.
The source: org.xsocket.connection.IoConnector:
private void handleConnect() {
Set<selectionkey> selectedEventKeys = selector.selectedKeys();
Iterator<selectionkey> it = selectedEventKeys.iterator();
while (it.hasNext()) {
SelectionKey eventKey = it.next();
it.remove();
RegisterTask registerTask = (RegisterTask) eventKey.attachment();
......
}
}</selectionkey></selectionkey>
The sink: org.xsocket.connection:
public IoSocketDispatcher(AbstractMemoryManager memoryManager, String name) {
......
try {
selector = Selector.open();
} catch (IOException ioe) {
String text = "exception occured while opening selector. Reason: " + ioe.toString();
LOG.severe(text);
throw new RuntimeException(text, ioe);
}
......
}
The statement "LOG.severe(text)" doesn't have LOG severe control.
The Tainted path:
org.xsocket.connection.IoConnector -->
org.xsocket.connection.IoConnector$RegisterTask -->
org.xsocket.connection.IoConnector -->
org.xsocket.connection.ConnectionManager -->
org.xsocket.connection.NonBlockingConnection$SyncIoConnectorCallback -->
org.xsocket.connection.ConnectionManager -->
org.xsocket.connection.NonBlockingConnection -->
org.xsocket.connection.NonBlockingConnection$SyncIoConnectorCallback -->
org.xsocket.connection.NonBlockingConnection -->
org.xsocket.connection.ConnectionManager -->
org.xsocket.connection.ConnectionManager$TimeoutMgmHandle -->
org.xsocket.connection.NonBlockingConnection -->
org.xsocket.connection.IoConnector$RegisterTask -->
org.xsocket.connection.NonBlockingConnection -->
org.xsocket.connection.ConnectionManager$TimeoutMgmHandle -->
org.xsocket.connection.NonBlockingConnection -->
org.xsocket.connection.IoSocketDispatcherPool
I am going to submit a CVE, so please confirm this is not a true positive.
Could I open a PR for it?