Skip to content

bugs #16842 #16843 #16845 fix: endless import, a 1ms wait per imported object - #113

Open
Regzox wants to merge 1 commit into
masterfrom
bug_16842
Open

Regzox wants to merge 1 commit into
masterfrom
bug_16842

Conversation

@Regzox

@Regzox Regzox commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

doProgressLog ended with a Thread.sleep(1) placed outside the log level
check, which is done inside doProgressLogWithoutInterruption. The wait was
therefore executed on every call, including when the message was filtered
out and displayed nowhere.

Yet this doProgressLog is called at OBJECTS level in the hot loops of the
import, while ImportThread sets the level to OBJECTS_GROUP in normal mode:
one wait per file extracted from the zip, per DataObjectGroup, per
BinaryDataObject, per PhysicalDataObject and per ArchiveUnit. On a SIP of
50,000 AUs and 50,000 binaries that is about 200,000 waits, i.e. 4 min on
Linux and up to 50 min on Windows where a 1ms sleep actually lasts 15.6ms.
During all that time the Treat and Export menus stay greyed out, since
setContextLoaded is only called from ImportThread.done(), hence the
inability to check SEDA compliance, check compliance to a profile and
export the SIP within the half hour following the opening.

  • SEDALibProgressLogger: the three Thread.sleep(1) are replaced by
    checkInterruption(), which throws InterruptedException if the interrupt
    flag is set. The cancellation semantics are identical, Thread.sleep doing
    nothing else on interruption, but the cost is zero.
  • SEDALibProgressLoggerTest: non-regression on the duration of filtered
    calls (20,000 calls under 2s, versus 23s before the fix) and on the
    propagation of cancellation by doProgressLog and doProgressLogIfStep.

This fix covers the three tickets opened on the same symptom: #16842 for
the SEDA 2.1 compliance check, #16843 for the compliance check against the
AN RNG profile and #16845 for the SIP export.

@vitam-prg

vitam-prg commented Sep 10, 2026

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Detailsa10befe9-bbee-4d64-a34d-f4a695cd6962


New Issues (59 out of 59) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL CVE-2026-59650 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 CRITICAL CVE-2026-8763 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 HIGH CVE-2026-12185 Maven-org.bouncycastle:bcprov-jdk15on-1.68
detailsRecommended version: 1.69.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2026-12802 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for J...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH CVE-2026-12803 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, "KCCMBlockCipher" MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also a...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH CVE-2026-12816 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 HIGH CVE-2026-12860 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castl...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 HIGH CVE-2026-13006 Maven-ch.qos.logback:logback-core-1.5.18
detailsRecommended version: 1.5.37
Description: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core through version 1.5.36 allows an attacker to execute arbitrar...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
9 HIGH CVE-2026-13506 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
10 HIGH CVE-2026-14682 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
11 HIGH CVE-2026-18401 Maven-com.fasterxml.jackson.core:jackson-core-2.18.3
detailsRecommended version: 2.18.6
Description: The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadCon...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
12 HIGH CVE-2026-18401 Maven-com.fasterxml.jackson.core:jackson-core-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadCon...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
13 HIGH CVE-2026-54512 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.6.redhat-00001
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 prior to 2.18.8, 2....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
14 HIGH CVE-2026-54512 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.4
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 prior to 2.18.8, 2....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
15 HIGH CVE-2026-54513 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.10.0 prior to 2.1...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
16 HIGH CVE-2026-54513 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.10.0 prior to 2.1...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
17 HIGH CVE-2026-58059 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
18 HIGH CVE-2026-58060 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy C...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
19 HIGH CVE-2026-58061 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
20 HIGH CVE-2026-59639 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CMS `verifySignatures` returns true for `SignedData` with zero signers. This issue also affects Bouncy Cas...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
21 HIGH CVE-2026-59642 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CMS AuthenticatedData content is not bound to the MAC when authAttrs are present. This issue also affects ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
22 HIGH CVE-2026-59644 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
23 HIGH CVE-2026-59645 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bo...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
24 HIGH CVE-2026-59651 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle f...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
25 HIGH CVE-2026-68497 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.10
Description: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string ve...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
26 HIGH CVE-2026-68497 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.6
Description: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string ve...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
27 HIGH CVE-2026-75140 Maven-org.jsoup:jsoup-1.21.1
detailsRecommended version: 1.23.2
Description: jsoup versions through 1.23.1, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in `XmlTreeBuilder` that allows...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
28 HIGH Cx2c9af752-2171 Maven-com.fasterxml.jackson.core:jackson-core-2.18.3
detailsRecommended version: 2.18.8
Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
29 HIGH Cx2c9af752-2171 Maven-com.fasterxml.jackson.core:jackson-core-2.20.0
detailsRecommended version: 2.21.4
Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
30 MEDIUM CVE-2026-0636 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.84
Description: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpr...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
31 MEDIUM CVE-2026-13586 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Ja...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
32 MEDIUM CVE-2026-15055 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
33 MEDIUM CVE-2026-19032 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.6
Description: jackson-databind's deserializer for `java.nio.file.Path` resolves an attacker-supplied URI without restricting the URI scheme. In `JDKFromStringDes...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
34 MEDIUM CVE-2026-19032 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.10
Description: jackson-databind's deserializer for `java.nio.file.Path` resolves an attacker-supplied URI without restricting the URI scheme. In `JDKFromStringDes...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
35 MEDIUM CVE-2026-19880 Maven-ch.qos.logback:logback-classic-1.5.19
detailsRecommended version: 1.6.3
Description: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
36 MEDIUM CVE-2026-19880 Maven-ch.qos.logback:logback-classic-1.5.18
detailsRecommended version: 1.6.3
Description: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
37 MEDIUM CVE-2026-28208 Maven-com.github.junrar:junrar-7.5.4
detailsRecommended version: 7.5.8
Description: Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allow...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
38 MEDIUM CVE-2026-28208 Maven-com.github.junrar:junrar-7.5.5
detailsRecommended version: 7.5.8
Description: Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allow...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
39 MEDIUM CVE-2026-49844 Maven-org.apache.logging.log4j:log4j-api-2.24.3
detailsRecommended version: 2.25.1.redhat-00001
Description: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
40 MEDIUM CVE-2026-49844 Maven-org.apache.logging.log4j:log4j-api-2.21.1
detailsRecommended version: 2.22.1.redhat-00002
Description: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
41 MEDIUM CVE-2026-54514 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.0.0 prior to 2.18...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
42 MEDIUM CVE-2026-54514 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.0.0 prior to 2.18...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
43 MEDIUM CVE-2026-54515 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 prior to 2.18.9, 2.1...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
44 MEDIUM CVE-2026-54515 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 prior to 2.18.9, 2.1...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
45 MEDIUM CVE-2026-5588 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
46 MEDIUM CVE-2026-58063 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, BCFKS keystore load honours unbounded KDF cost from an untrusted file. This issue also affects Bouncy Cast...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
47 MEDIUM CVE-2026-59647 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LT...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
48 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.4
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
49 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.8
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
50 MEDIUM CVE-2026-59889 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
51 MEDIUM CVE-2026-71497 Maven-org.jsoup:jsoup-1.21.1
detailsRecommended version: 1.23.1
Description: jsoup is a Java library for working with real-world HTML. From 1.14.3 prior to 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
52 MEDIUM CVE-2026-77310 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.9
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.x prior to versions 2....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
53 MEDIUM CVE-2026-77310 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.5
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.x prior to versions 2....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
54 MEDIUM CVE-2026-83557 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configu...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
55 MEDIUM CVE-2026-83557 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configu...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
56 LOW CVE-2026-10532 Maven-ch.qos.logback:logback-core-1.5.18
detailsRecommended version: 1.5.34
Description: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Objec...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
57 LOW CVE-2026-86071 Maven-com.github.junrar:junrar-7.5.5
detailsRecommended version: 7.6.1
Description: Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtra...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
58 LOW CVE-2026-86071 Maven-com.github.junrar:junrar-7.5.4
detailsRecommended version: 7.6.1
Description: Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtra...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
59 LOW CVE-2026-9828 Maven-ch.qos.logback:logback-core-1.5.18
detailsRecommended version: 1.5.33
Description: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Objec...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package

Fixed Issues (2) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.18.3
HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.20.0

Use @Checkmarx to take action directly from this PR:

  • Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR

@Regzox Regzox self-assigned this Sep 10, 2026
@Regzox Regzox added the bug Something isn't working label Sep 10, 2026
…d object

doProgressLog ended with a Thread.sleep(1) placed outside the log level
check, which is done inside doProgressLogWithoutInterruption. The wait was
therefore executed on every call, including when the message was filtered
out and displayed nowhere.

Yet this doProgressLog is called at OBJECTS level in the hot loops of the
import, while ImportThread sets the level to OBJECTS_GROUP in normal mode:
one wait per file extracted from the zip, per DataObjectGroup, per
BinaryDataObject, per PhysicalDataObject and per ArchiveUnit. On a SIP of
50,000 AUs and 50,000 binaries that is about 200,000 waits, i.e. 4 min on
Linux and up to 50 min on Windows where a 1ms sleep actually lasts 15.6ms.
During all that time the Treat and Export menus stay greyed out, since
setContextLoaded is only called from ImportThread.done(), hence the
inability to check SEDA compliance, check compliance to a profile and
export the SIP within the half hour following the opening.

- SEDALibProgressLogger: the three Thread.sleep(1) are replaced by
  checkInterruption(), which throws InterruptedException if the interrupt
  flag is set. The cancellation semantics are identical, Thread.sleep doing
  nothing else on interruption, but the cost is zero.
- SEDALibProgressLoggerTest: non-regression on the duration of filtered
  calls (20,000 calls under 2s, versus 23s before the fix) and on the
  propagation of cancellation by doProgressLog and doProgressLogIfStep.

This fix covers the three tickets opened on the same symptom: #16842 for
the SEDA 2.1 compliance check, #16843 for the compliance check against the
AN RNG profile and #16845 for the SIP export.
@Regzox Regzox changed the title bug #16842 fix: import interminable, une attente d'1ms par objet importé bugs #16842 #16843 #16845 fix: endless import, a 1ms wait per imported object Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants