按照您的意思我修改代码如下:可是仍然有高危错误. public class BaseAction extends Action { private WebApplicationContext wac; protected ServletContext context; public void setServlet(ActionServlet actionServlet){ super.setServlet(actionServlet); if(wac==null){ context = actionServlet.getServletContext(); wac = WebApplicationContextUtils.getRequiredWebApplicationContext(context); } }
protected Object getBean(String beanName) { return wac.getBean(beanName); } } 错误报告如下: ABSTRACT Servlet member fields may allow one user to see another user's data.
EXPLANATION Many Servlet developers do not understand that, unless a Servlet implements the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the Servlet, and that single instance is used and re-used to handle multiple requests that are processed simultaneously by different threads.
A common result of this misunderstanding is that developers use Servlet member fields in such a way that one user may inadvertently see another user's data. In other words, storing user data in Servlet member fields introduces a data access race condition.
Example 1: The following Servlet stores the value of a request parameter in a member field and then later echoes the parameter value to the response output stream.
public class GuestBook extends HttpServlet {
String name;
protected void doPost (HttpServletRequest req, HttpServletResponse res) { name = req.getParameter("name"); ... out.println(name + ", thanks for visiting!"); } }
While this code will work perfectly in a single-user environment, if two users access the Servlet at approximately the same time, it is possible for the two request handler threads to interleave in the following way:
Thread 1: assign "Dick" to name Thread 2: assign "Jane" to name Thread 1: print "Jane, thanks for visiting!" Thread 2: print "Jane, thanks for visiting!"
Thereby showing the first user the second user's name.
RECOMMENDATIONS Do not use Servlet member fields for anything but constants. (i.e. make all member fields static final).
Developers are often tempted to use Servlet member fields for user data when they need to transport data from one region of code to another. If this is your aim, consider declaring a separate class and using the Servlet only to "wrap" this new class.
Example 2: The bug in the example above can be corrected in the following way:
public void handle(HttpServletRequest req, HttpServletResponse res) { name = req.getParameter("name"); ... out.println(name + ", thanks for visiting!"); }
}
Alternatively, a Servlet can implement the SingleThreadModel interface, in which case the Servlet container will maintain a pool of Servlet objects and dispatch a different object to process each request. Depending on the container implementation and the needs of the application, using the SingleThreadModel interface may cause significant performance problems.
REFERENCES
[1] The Java Servlet Specification, Sun Microsystems, http://java.sun.com/products/servlet/download.html