fixes https://luceeserver.atlassian.net/browse/LDEV-947

core/src/main/java/lucee/runtime/net/http/HTTPServletRequestWrap.java

@@ -30,6 +30,7 @@
 import java.util.LinkedList;
 import java.util.Locale;
 import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 import javax.servlet.AsyncContext;
 import javax.servlet.DispatcherType;
@@ -199,13 +200,13 @@ public RequestDispatcher getOriginalRequestDispatcher(String realpath) {
 	}
 
 	@Override
-	public void removeAttribute(String name) {
+	public synchronized void removeAttribute(String name) {
 		if(disconnected) disconnectData.attributes.remove(name); 
 		else req.removeAttribute(name);
 	}
 
 	@Override
-	public void setAttribute(String name, Object value) {
+	public synchronized void setAttribute(String name, Object value) {
 		if(disconnected) disconnectData.attributes.put(name, value);
 		else req.setAttribute(name, value);
 	}
@@ -216,13 +217,13 @@ public void setAttribute(String name, Object value) {
 
 
 	@Override
-	public Object getAttribute(String name) {
+	public synchronized Object getAttribute(String name) {
 		if(disconnected) return disconnectData.attributes.get(name);
 		return req.getAttribute(name);
 	}
 
 	@Override
-	public Enumeration getAttributeNames() {
+	public synchronized Enumeration getAttributeNames() {
 		if(disconnected) {
 			return new EnumerationWrapper(disconnectData.attributes);
 		}
@@ -351,14 +352,14 @@ public HttpServletRequest getOriginalRequest() {
 		return req;
 	}
 
-	public void disconnect(PageContextImpl pc) {
+	public synchronized void disconnect(PageContextImpl pc) {
 		if(disconnected) return;
 		disconnectData=new DisconnectData();
 
 		// attributes
 		{
 			Enumeration<String> attrNames = req.getAttributeNames();
-			disconnectData.attributes=new HashMap<String, Object>();
+			disconnectData.attributes=new ConcurrentHashMap<String, Object>();
 			String k;
 			while(attrNames.hasMoreElements()){
 				k=attrNames.nextElement();
@@ -369,7 +370,7 @@ public void disconnect(PageContextImpl pc) {
 		// headers
 		{
 			Enumeration headerNames = req.getHeaderNames();
-			disconnectData.headers=new HashMap<Collection.Key, LinkedList<String>>();
+			disconnectData.headers=new ConcurrentHashMap<Collection.Key, LinkedList<String>>();
 
 			String k;
 			Enumeration e;

core/src/main/java/lucee/runtime/type/scope/ScopeContext.java

@@ -520,15 +520,15 @@ else if("registry".equalsIgnoreCase(storage)) {
 			}
 
 			Session existing=(Session) context.get(pc.getCFID());
+			if(existing!=null && (existing.isExpired() || !(existing instanceof StorageScope))) existing=null; // second should not happen
+
 			Session session=appContext.getSessionCluster()?null:existing;
 
-			if(session==null || !(session instanceof StorageScope) || session.isExpired() || !((StorageScope)session).getStorage().equalsIgnoreCase(storage)) {
-				if(!(existing instanceof StorageScope) || existing.isExpired()) existing=null;
+			if(session==null || !((StorageScope)session).getStorage().equalsIgnoreCase(storage)) {
 				// not necessary to check session in the same way, because it is overwritten anyway
 				if(isMemory){
 					if(existing!=null) session=existing;
 					else session=SessionMemory.getInstance(pc,isNew,getLog());
-
 				}
 				else if("file".equals(storage)){
 					session=SessionFile.getInstance(appContext.getName(),pc,getLog());

loader/build.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project default="core" basedir="." name="Lucee" xmlns:artifact="antlib:org.apache.maven.artifact.ant">
 
-  <property name="version" value="5.0.1.34-SNAPSHOT"/>
+  <property name="version" value="5.0.1.35-SNAPSHOT"/>
 
   <path id="maven-ant-tasks.classpath" path="../ant/lib/maven-ant-tasks-2.1.3.jar" />
   <typedef resource="org/apache/maven/artifact/ant/antlib.xml"

loader/pom.xml

@@ -11,7 +11,7 @@
 
   <groupId>org.lucee</groupId>
   <artifactId>lucee</artifactId>
-  <version>5.0.1.34-SNAPSHOT</version>
+  <version>5.0.1.35-SNAPSHOT</version>
   <packaging>jar</packaging>
 
   <name>Lucee Loader Build</name>