From 9d6d3aa1c3da0b1e91f5d429066ecd067f9760f4 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Wed, 8 Jul 2026 17:37:27 +0300 Subject: [PATCH] Qualify the LinkedHashMap size() call in removeEldestEntry (CodeQL java/subtle-inherited-call) The anonymous LinkedHashMap that backs AccessTokenValidationCache overrides removeEldestEntry and calls an unqualified size(). That resolves to LinkedHashMap.size() (correct), but the enclosing AccessTokenValidationCache also declares a size() method, so the call is easy to misread as the enclosing one - which would re-acquire the read lock while put() already holds the write lock. Qualify the call as super.size() to make it explicit that it is the map's own inherited size. Behaviour is unchanged: the unqualified call already bound to LinkedHashMap.size(). --- .../authz/modules/oauth2/AccessTokenValidationCache.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/commons/auth-filters/authz-filter/modules/oauth2-module/src/main/java/org/forgerock/authz/modules/oauth2/AccessTokenValidationCache.java b/commons/auth-filters/authz-filter/modules/oauth2-module/src/main/java/org/forgerock/authz/modules/oauth2/AccessTokenValidationCache.java index 3b0bd1cae3..42cb027220 100644 --- a/commons/auth-filters/authz-filter/modules/oauth2-module/src/main/java/org/forgerock/authz/modules/oauth2/AccessTokenValidationCache.java +++ b/commons/auth-filters/authz-filter/modules/oauth2-module/src/main/java/org/forgerock/authz/modules/oauth2/AccessTokenValidationCache.java @@ -12,6 +12,7 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2014 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC */ package org.forgerock.authz.modules.oauth2; @@ -47,7 +48,11 @@ class AccessTokenValidationCache { @Override protected boolean removeEldestEntry(Map.Entry eldestEntry) { - return size() > maxSize; + // size() refers to this LinkedHashMap's own size, not the enclosing + // AccessTokenValidationCache.size() (which would re-acquire the read lock while a + // put() already holds the write lock). Qualify with super to make that explicit + // (CodeQL java/subtle-inherited-call). + return super.size() > maxSize; } }; }