Empty Synchronized Block

Draft Variant

Structure: Simple

Description

An empty synchronized block is a Java code construct where a synchronized block exists but contains no executable statements inside it.

Extended Description

An empty synchronized block is a logic flaw that fails to provide any actual thread safety or mutual exclusion. While the synchronized keyword is present, the block does nothing to protect shared data or coordinate threads, leaving critical sections of your code vulnerable to race conditions and concurrency bugs. This issue often arises during code maintenance, such as when a developer comments out or removes the internal logic for debugging but forgets to remove the now-useless synchronization wrapper. It serves as a clear red flag for developers to review that section of code, as it either indicates missing functionality or unnecessary overhead that can harm performance without benefit.

Common Consequences 1

Scope: Other

Impact: Other

An empty synchronized block will wait until nobody else is using the synchronizer being specified. While this may be part of the desired behavior, because you haven't protected the subsequent code by placing it inside the synchronized block, nothing is stopping somebody else from modifying whatever it was you were waiting for while you run the subsequent code.

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Potential Mitigations 1

Phase: Implementation

When you come across an empty synchronized statement, or a synchronized statement in which the code has been commented out, try to determine what the original intentions were and whether or not the synchronized block is still necessary.

Demonstrative Examples 1

ID : DX-214

The following code attempts to synchronize on an object, but does not execute anything in the synchronized block. This does not actually accomplish anything and may be a sign that a programmer is wrestling with synchronization but has not yet achieved the result they intend.

Code Example:Bad
Java
java

Instead, in a correct usage, the synchronized statement should contain procedures that access or modify data that is exposed to multiple threads. For example, consider a scenario in which several threads are accessing student records at the same time. The method which sets the student ID to a new value will need to make sure that nobody else is accessing this data at the same time and will require synchronization.

Code Example:Good
Java
java

References 1

Intrinsic Locks and Synchronization (in Java)

https://docs.oracle.com/javase/tutorial/essential/concurrency/locksync.html(2023-04-07)

ID: REF-478

Applicable Platforms

Languages:

Java : Undetermined

Modes of Introduction

Implementation

Related Weaknesses

ChildOf:

Empty Code Block (CWE-1071)

Taxonomy Mapping

Software Fault Patterns