[maven-4.0.x] DefaultProfileInjector: non-atomic computeIfAbsent on synchronized WeakHashMap

[elharo]

DefaultProfileInjector: Non-atomic computeIfAbsent on synchronized WeakHashMap

Found in: maven-4.0.x branch
File: impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultProfileInjector.java (lines 56, 68-70)
Severity: High

Description

Collections.synchronizedMap() only synchronizes individual method calls, but computeIfAbsent() is a compound operation. Since WeakHashMap does not override computeIfAbsent(), two threads can execute the inner map creation concurrently:

Model result = CACHE.computeIfAbsent(model, k -> new ConcurrentHashMap<>())
        .computeIfAbsent(profiles, l -> doInjectProfiles(model, profiles));

One thread's inner ConcurrentHashMap can be discarded (and its profile results lost). This causes profile injection cache inconsistency under concurrent model building in multi-module reactor builds.