#5612

Committed 11 Jul 2026 03:47PM UTC coverage: 71.292% (-28.7%) from 100.0%

Build # #5612

Build Type

push

github

Committed by

ben-manes

Commit Message

Preserve timestamps on a raced same-instance refresh

The automatic refreshIfNeeded path checked for an equal-value reload
before the ABA/ownership check and returned without preserving the
timestamps, so a reload completing after a concurrent put(k,
sameInstance) did a full update — shifting the entry's expiration
forward by the reload's in-flight duration and stomping the write.
Mirror the explicit-refresh fix: check ownership first. An owned
reload installs the value (refreshing metadata even for a same
instance), while a raced reload preserves the write's timestamps and
only notifies REPLACED when the value differs.

Coverage Stats

2957 of 4134 branches covered (71.53%)

3 of 3 new or added lines in 1 file covered. (100.0%)

2408 existing lines in 53 files now uncovered.

5980 of 8388 relevant lines covered (71.29%)

0.71 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/jcache/src/main/java/com/github/benmanes/caffeine/jcache/copy/JavaSerializationCopier.java

/*
 * Copyright 2015 Ben Manes. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.github.benmanes.caffeine.jcache.copy;

import static java.util.Objects.requireNonNull;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamClass;
import java.io.UncheckedIOException;
import java.util.Map;
import java.util.Set;
import java.util.function.Function;

import javax.cache.CacheException;

import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
 * A strategy that uses Java serialization if a fast path approach is not applicable.
 * <p>
 * Beware that Java serialization is slow, can be insecure, and is provided due to being required
 * by JSR-107. In practice, it is recommended that a higher performance alternative is used, which
 * is provided by numerous external libraries. If serialization must be used then consider supplying
 * an {@link ObjectInputFilter} or enabling
 * <a href="http://docs.oracle.com/en/java/javase/25/core/serialization-filtering1.html">
 * Serialization Filtering</a> to restrict the classes that can be deserialized.
 *
 * @author ben.manes@gmail.com (Ben Manes)
 */
@NullMarked
public class JavaSerializationCopier extends AbstractCopier<byte[]> {
  private final @Nullable ObjectInputFilter objectInputFilter;

  public JavaSerializationCopier() {
    this(javaImmutableClasses(), javaDeepCopyStrategies());
  }

  public JavaSerializationCopier(Set<Class<?>> immutableClasses,
      Map<Class<?>, Function<Object, Object>> deepCopyStrategies) {
    super(immutableClasses, deepCopyStrategies);
    this.objectInputFilter = null;
  }

  public JavaSerializationCopier(Set<Class<?>> immutableClasses,
      Map<Class<?>, Function<Object, Object>> deepCopyStrategies,
      ObjectInputFilter objectInputFilter) {
    super(immutableClasses, deepCopyStrategies);
    this.objectInputFilter = objectInputFilter;
  }

  @Override
  protected byte[] serialize(Object object) {
    var bytes = new ByteArrayOutputStream();
    try (var output = new ObjectOutputStream(bytes)) {
      output.writeObject(object);
    } catch (IOException e) {
      throw new UncheckedIOException("Failed to serialize " + object.getClass(), e);
    }
    return bytes.toByteArray();
  }

  @Override
  @SuppressWarnings("BanSerializableRead")
  protected Object deserialize(byte[] data, ClassLoader classLoader) {
    try (var bytes = new ByteArrayInputStream(data);
         var input = newInputStream(bytes, classLoader)) {
      return input.readObject();
    } catch (IOException e) {
      throw new CacheException("Failed to deserialize", e);
    } catch (ClassNotFoundException e) {
      throw new CacheException("Failed to resolve a deserialized class", e);
    }
  }

  // @VisibleForTesting
  ObjectInputStream newInputStream(
      InputStream in, ClassLoader classLoader) throws IOException {
    var stream = new ClassLoaderAwareObjectInputStream(in, classLoader);
    if (objectInputFilter != null) {
      stream.setObjectInputFilter(objectInputFilter);
    }
    return stream;
  }

  /** An {@linkplain ObjectInputStream} that instantiates using the supplied classloader. */
  protected static class ClassLoaderAwareObjectInputStream extends ObjectInputStream {
    private final ClassLoader classLoader;

    public ClassLoaderAwareObjectInputStream(InputStream in, ClassLoader classLoader)
        throws IOException {
      super(in);
      this.classLoader = requireNonNull(classLoader);
    }

    protected ClassLoader getClassLoader() {
      return classLoader;
    }

    @Override
    @SuppressWarnings("BanSerializableRead")
    protected Class<?> resolveClass(ObjectStreamClass desc)
        throws IOException, ClassNotFoundException {
      try {
        return Class.forName(desc.getName(), /* initialize= */ false, getClassLoader());
      } catch (ClassNotFoundException ignored) {
        return super.resolveClass(desc);
      }
    }
  }
}

1	/*
2	* Copyright 2015 Ben Manes. All Rights Reserved.
3	*
4	* Licensed under the Apache License, Version 2.0 (the "License");
5	* you may not use this file except in compliance with the License.
6	* You may obtain a copy of the License at
7	*
8	* http://www.apache.org/licenses/LICENSE-2.0
9	*
10	* Unless required by applicable law or agreed to in writing, software
11	* distributed under the License is distributed on an "AS IS" BASIS,
12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	* See the License for the specific language governing permissions and
14	* limitations under the License.
15	*/
16	package com.github.benmanes.caffeine.jcache.copy;
17
18	import static java.util.Objects.requireNonNull;
19
20	import java.io.ByteArrayInputStream;
21	import java.io.ByteArrayOutputStream;
22	import java.io.IOException;
23	import java.io.InputStream;
24	import java.io.ObjectInputFilter;
25	import java.io.ObjectInputStream;
26	import java.io.ObjectOutputStream;
27	import java.io.ObjectStreamClass;
28	import java.io.UncheckedIOException;
29	import java.util.Map;
30	import java.util.Set;
31	import java.util.function.Function;
32
33	import javax.cache.CacheException;
34
35	import org.jspecify.annotations.NullMarked;
36	import org.jspecify.annotations.Nullable;
37
38	/**
39	* A strategy that uses Java serialization if a fast path approach is not applicable.
40	* <p>
41	* Beware that Java serialization is slow, can be insecure, and is provided due to being required
42	* by JSR-107. In practice, it is recommended that a higher performance alternative is used, which
43	* is provided by numerous external libraries. If serialization must be used then consider supplying
44	* an {@link ObjectInputFilter} or enabling
45	* <a href="http://docs.oracle.com/en/java/javase/25/core/serialization-filtering1.html">
46	* Serialization Filtering</a> to restrict the classes that can be deserialized.
47	*
48	* @author ben.manes@gmail.com (Ben Manes)
49	*/
50	@NullMarked
51	public class JavaSerializationCopier extends AbstractCopier<byte[]> {
52	private final @Nullable ObjectInputFilter objectInputFilter;
53
54	public JavaSerializationCopier() {
UNCOV 55	this(javaImmutableClasses(), javaDeepCopyStrategies());	×
UNCOV 56	}	×
57
58	public JavaSerializationCopier(Set<Class<?>> immutableClasses,
59	Map<Class<?>, Function<Object, Object>> deepCopyStrategies) {
UNCOV 60	super(immutableClasses, deepCopyStrategies);	×
UNCOV 61	this.objectInputFilter = null;	×
UNCOV 62	}	×
63
64	public JavaSerializationCopier(Set<Class<?>> immutableClasses,
65	Map<Class<?>, Function<Object, Object>> deepCopyStrategies,
66	ObjectInputFilter objectInputFilter) {
UNCOV 67	super(immutableClasses, deepCopyStrategies);	×
UNCOV 68	this.objectInputFilter = objectInputFilter;	×
UNCOV 69	}	×
70
71	@Override
72	protected byte[] serialize(Object object) {
UNCOV 73	var bytes = new ByteArrayOutputStream();	×
UNCOV 74	try (var output = new ObjectOutputStream(bytes)) {	×
UNCOV 75	output.writeObject(object);	×
UNCOV 76	} catch (IOException e) {	×
UNCOV 77	throw new UncheckedIOException("Failed to serialize " + object.getClass(), e);	×
UNCOV 78	}	×
UNCOV 79	return bytes.toByteArray();	×
80	}
81
82	@Override
83	@SuppressWarnings("BanSerializableRead")
84	protected Object deserialize(byte[] data, ClassLoader classLoader) {
UNCOV 85	try (var bytes = new ByteArrayInputStream(data);	×
UNCOV 86	var input = newInputStream(bytes, classLoader)) {	×
UNCOV 87	return input.readObject();	×
UNCOV 88	} catch (IOException e) {	×
UNCOV 89	throw new CacheException("Failed to deserialize", e);	×
UNCOV 90	} catch (ClassNotFoundException e) {	×
UNCOV 91	throw new CacheException("Failed to resolve a deserialized class", e);	×
92	}
93	}
94
95	// @VisibleForTesting
96	ObjectInputStream newInputStream(
97	InputStream in, ClassLoader classLoader) throws IOException {
UNCOV 98	var stream = new ClassLoaderAwareObjectInputStream(in, classLoader);	×
UNCOV 99	if (objectInputFilter != null) {	×
UNCOV 100	stream.setObjectInputFilter(objectInputFilter);	×
101	}
UNCOV 102	return stream;	×
103	}
104
105	/** An {@linkplain ObjectInputStream} that instantiates using the supplied classloader. */
106	protected static class ClassLoaderAwareObjectInputStream extends ObjectInputStream {
107	private final ClassLoader classLoader;
108
109	public ClassLoaderAwareObjectInputStream(InputStream in, ClassLoader classLoader)
110	throws IOException {
UNCOV 111	super(in);	×
UNCOV 112	this.classLoader = requireNonNull(classLoader);	×
UNCOV 113	}	×
114
115	protected ClassLoader getClassLoader() {
UNCOV 116	return classLoader;	×
117	}
118
119	@Override
120	@SuppressWarnings("BanSerializableRead")
121	protected Class<?> resolveClass(ObjectStreamClass desc)
122	throws IOException, ClassNotFoundException {
123	try {
UNCOV 124	return Class.forName(desc.getName(), /* initialize= */ false, getClassLoader());	×
UNCOV 125	} catch (ClassNotFoundException ignored) {	×
UNCOV 126	return super.resolveClass(desc);	×
127	}
128	}
129	}
130	}

ben-manes / caffeine / #5612

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous