fix: issue 5452 - ConcurrentModificationException in NodePackageAnaly…

…zer.processDependencies - adding synchronized block (#6501) Co-authored-by: Grzegorz Dabrowski <[email protected]>
jeremylong · Mar 5, 2024 · 44a3f16 · 44a3f16
1 parent 873289e
commit 44a3f16
Showing 1 changed file with 11 additions and 10 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
@@ -458,18 +458,19 @@ private void processDependencies(JsonObject json, File baseDir, File rootFile,
                         LOGGER.debug("Unable to build package url for `" + packagePath + "`", ex);
                     }
                 }
-
-                final Dependency existing = findDependency(engine, name, version);
-                if (existing != null) {
-                    if (existing.isVirtual()) {
-                        DependencyMergingAnalyzer.mergeDependencies(child, existing, null);
-                        engine.removeDependency(existing);
-                        engine.addDependency(child);
+                synchronized (this) {
+                    final Dependency existing = findDependency(engine, name, version);
+                    if (existing != null) {
+                        if (existing.isVirtual()) {
+                            DependencyMergingAnalyzer.mergeDependencies(child, existing, null);
+                            engine.removeDependency(existing);
+                            engine.addDependency(child);
+                        } else {
+                            DependencyBundlingAnalyzer.mergeDependencies(existing, child, null);
+                        }
                     } else {
-                        DependencyBundlingAnalyzer.mergeDependencies(existing, child, null);
+                        engine.addDependency(child);
                     }
-                } else {
-                    engine.addDependency(child);
                 }
             }
         }