EjbSynchronization.ql

/**
 * @name EJB uses synchronization
 * @description An EJB should not use synchronization, since it will not work properly
 *              if an EJB is distributed across multiple JVMs.
 * @kind problem
 * @problem.severity error
 * @precision low
 * @id java/ejb/synchronization
 * @tags reliability
 *       external/cwe/cwe-574
 */
import java
import semmle.code.java.frameworks.javaee.ejb.EJB
import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions

/*
JSR 220: Enterprise JavaBeansTM,Version 3.0
EJB Core Contracts and Requirements
Section 21.1.2 Programming Restrictions

- An enterprise bean must not use thread synchronization primitives to synchronize execution of
multiple instances.

This is for the same reason as above. Synchronization would not work if the EJB container distributed
enterprise bean's instances across multiple JVMs.
*/

from Callable origin, ForbiddenSynchronizationCallable target, Call call
where ejbCalls(origin, target, call)
select origin, "EJB should not use synchronization by calling $@.",
  call, target.getDeclaringType().getName() + "." + target.getName()