Iteration Over Non-Concurrent Collection Without Synchronization

ID

java.concurrent_collection_iteration

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

CWE:362, concurrency, reliability

Description

Reports enhanced-for loops that iterate over a field whose declared type is a standard (non-concurrent) collection (ArrayList, HashMap, HashSet, etc.) outside a synchronized block. Iterating while another thread modifies the collection throws ConcurrentModificationException or silently produces corrupted results.

Rationale

Standard Java collections are not thread-safe. The fail-fast iterators used by ArrayList, HashMap, etc. detect concurrent structural modification and throw ConcurrentModificationException, but this detection is best-effort: silent data corruption is also possible.

// Bad -- if another thread adds to 'items', ConcurrentModificationException
private ArrayList<String> items = new ArrayList<>();

public void process() {
    for (String item : items) {
        handle(item);
    }
}

Remediation

Use a thread-safe collection or synchronize the iteration:

// Good -- CopyOnWriteArrayList
private CopyOnWriteArrayList<String> items = new CopyOnWriteArrayList<>();

// Good -- synchronized iteration
synchronized (items) {
    for (String item : items) {
        handle(item);
    }
}

References