From 90cce51e418e7fa8636033a4d6b96cc3bb49641b Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Thu, 30 Jul 2026 13:48:20 +0000
Subject: [PATCH] Fix CodeQL warning-severity alerts: weak salt PRNG, unsafe DCL, thread-unsafe date formats (#789)
---
opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/ConfigFromConnection.java | 28 ++++++++++++++++++++++++----
1 files changed, 24 insertions(+), 4 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/ConfigFromConnection.java b/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/ConfigFromConnection.java
index 7c49b13..edaafa1 100644
--- a/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/ConfigFromConnection.java
+++ b/opendj-server-legacy/src/main/java/org/opends/guitools/controlpanel/util/ConfigFromConnection.java
@@ -13,6 +13,7 @@
*
* Copyright 2008-2011 Sun Microsystems, Inc.
* Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.guitools.controlpanel.util;
@@ -135,14 +136,33 @@
}
}
- /** The date formatter to be used to parse GMT dates. */
- public static final SimpleDateFormat utcParser = new SimpleDateFormat(ServerConstants.DATE_FORMAT_GMT_TIME);
+ /**
+ * Returns a date formatter to be used to parse GMT dates.
+ * <p>
+ * A new instance is returned by each call because {@link SimpleDateFormat} is not thread-safe and
+ * this method is called from several threads.
+ *
+ * @return a date formatter to be used to parse GMT dates
+ */
+ public static SimpleDateFormat newUtcParser()
{
+ SimpleDateFormat utcParser = new SimpleDateFormat(ServerConstants.DATE_FORMAT_GMT_TIME);
utcParser.setTimeZone(TimeZone.getTimeZone("UTC"));
+ return utcParser;
}
- /** The date formatter to be used to format dates. */
- public static final DateFormat formatter = DateFormat.getDateTimeInstance();
+ /**
+ * Returns a date formatter to be used to format dates.
+ * <p>
+ * A new instance is returned by each call because {@link DateFormat} is not thread-safe and this
+ * method is called from several threads.
+ *
+ * @return a date formatter to be used to format dates
+ */
+ public static DateFormat newDateFormatter()
+ {
+ return DateFormat.getDateTimeInstance();
+ }
/**
* Returns the monitoring entry for the entry caches.
--
Gitblit v1.10.0