Brace for your next Race - Race conditions in Servlets and Controllers

on YouTube ↗44m

" summary

Demonstrates a real race on a Spring MVC controller and J2EE servlet where a shopping-basket coupon handler subtracts the discount multiple times; a local demo sends ~300 concurrent requests with Turbo Intruder through Burp Suite and observes four wrong responses (examples: 21.87 or even negative totals). Fixes shown include using ReentrantLock, semaphores or synchronized blocks and switching the bean to @Scope("request"); locks eliminate the duplicates but add contention and potential performance costs.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 1:30Survey
3. 2:17Who am I
4. 3:09Agenda
5. 4:16Race conditions
6. 5:15What are race conditions
7. 8:07Race conditions in Security
8. 10:41Coupon application
9. 14:43Example code
10. 18:58Running the Trace
11. 25:21Basket Controller
12. 29:04Other approaches
13. 32:23Scope Prototype
14. 35:32Conclusion

" related talks

• 01h 24mFastest Servlets in the West?Stuart Willliams, Daniel Mikusa · SpringOne2GX 2014
• 01h 01mReactive web servicesKamil Szymański · Build Stuff 2017
• 01h 11mServlet or Reactive Stacks: The Choice is Yours. Oh No... The Choice is Mine! - Rossen StoyanchevRossen Stoyanchev · SpringOne Platform 2017
• 46mServlet 4 0: A New Twist on an Old FavoriteEd Burns, Shing wai Chan · Oracle OpenWorld 2017
• 42mA Race To The Bottom: Database Transactions Undermining Your AppSecViktor Chuchurski · Global AppSec Lisbon 2024
• 38mSmashing the State Machine: The True Potential of Web Race ConditionsJames Kettle · Black Hat USA 2023
• 37mDataBinding2Shell: Novel Pathways to RCE Web FrameworksBiao He, Haowen Mu · Black Hat Europe 2022
• 44mSmashing The State Machine: The True Potential Of Web Race ConditionsJames · Nullcon Goa 2023