Race Conditions Remediation

// ❌ VULNERABLE: Non-atomic check-then-act
private int balance = 1000;

public boolean withdraw(int amount) {
    if (balance >= amount) {  // Race!
        balance -= amount;
        return true;
    }
    return false;
}

// ✅ SECURE: Synchronized method
private int balance = 1000;

public synchronized boolean withdraw(int amount) {
    if (balance >= amount) {
        balance -= amount;
        return true;
    }
    return false;
}

// ✅ SECURE: Use concurrent collections
import java.util.concurrent.atomic.AtomicInteger;

private AtomicInteger balance = new AtomicInteger(1000);

public boolean withdraw(int amount) {
    while (true) {
        int current = balance.get();
        if (current < amount) {
            return false;
        }
        int next = current - amount;
        if (balance.compareAndSet(current, next)) {
            return true;  // Success!
        }
        // CAS failed, retry
    }
}

// ✅ SECURE: ReentrantLock with conditions
import java.util.concurrent.locks.Lock;
import java.util.concurrent.locks.ReentrantLock;

private final Lock lock = new ReentrantLock();

public boolean withdraw(int amount) {
    lock.lock();
    try {
        if (balance >= amount) {
            balance -= amount;
            return true;
        }
        return false;
    } finally {
        lock.unlock();
    }
}

// ✅ SECURE: Redis distributed lock with Redlock algorithm
const redis = require('redis');
const { promisify } = require('util');

async function acquireLock(client, lockKey, ttl = 5000) {
    const lockValue = crypto.randomUUID();
    
    // SET with NX (only if not exists) and PX (TTL in ms)
    const result = await client.set(
        lockKey,
        lockValue,
        'NX',
        'PX',
        ttl
    );
    
    if (result === 'OK') {
        return lockValue;  // Lock acquired
    }
    return null;  // Lock held by another process
}

async function releaseLock(client, lockKey, lockValue) {
    // Use Lua script for atomic check-and-delete
    const script = `
        if redis.call("get", KEYS[1]) == ARGV[1] then
            return redis.call("del", KEYS[1])
        else
            return 0
        end
    `;
    
    await client.eval(script, 1, lockKey, lockValue);
}

// Usage
async function processWithLock() {
    const lockValue = await acquireLock(redisClient, 'resource:123');
    if (!lockValue) {
        throw new Error('Could not acquire lock');
    }
    
    try {
        // Critical section
        await performTransaction();
    } finally {
        await releaseLock(redisClient, 'resource:123', lockValue);
    }
}

// ❌ VULNERABLE: Unprotected state transitions
class Order {
    constructor() {
        this.status = 'pending';
    }
    
    approve() {
        this.status = 'approved';  // Race!
    }
    
    cancel() {
        this.status = 'cancelled';  // Could overwrite approval!
    }
}

// ✅ SECURE: Atomic state transitions with validation
class OrderSafe {
    constructor() {
        this.status = 'pending';
        this.version = 0;
    }
    
    async transitionTo(newStatus, expectedVersion) {
        // Database enforces version check atomically
        const result = await db.query(
            `UPDATE orders 
             SET status = $1, version = version + 1
             WHERE id = $2 
               AND status = $3
               AND version = $4`,
            [newStatus, this.id, this.status, expectedVersion]
        );
        
        if (result.rowCount === 0) {
            throw new Error('Invalid state transition or concurrent modification');
        }
        
        this.status = newStatus;
        this.version++;
    }
    
    async approve() {
        if (this.status !== 'pending') {
            throw new Error('Can only approve pending orders');
        }
        await this.transitionTo('approved', this.version);
    }
}

// ✅ SECURE: State machine with explicit transitions
const validTransitions = {
    'pending': ['approved', 'cancelled'],
    'approved': ['shipped'],
    'shipped': ['delivered'],
    'cancelled': [],  // Terminal state
    'delivered': []   // Terminal state
};

function canTransition(currentState, newState) {
    return validTransitions[currentState]?.includes(newState) || false;
}

import threading
import time

# Test for race conditions with concurrent threads
def test_concurrent_withdrawal():
    balance = Account(1000)
    threads = []
    
    # Try to withdraw $600 twice simultaneously (should fail once)
    def withdraw_thread():
        result = balance.withdraw(600)
        print(f"Withdrawal {'succeeded' if result else 'failed'}")
    
    # Launch multiple threads
    for _ in range(2):
        t = threading.Thread(target=withdraw_thread)
        threads.append(t)
        t.start()
    
    # Wait for completion
    for t in threads:
        t.join()
    
    final_balance = balance.get_balance()
    print(f"Final balance: {final_balance}")
    
    # Should be either 400 (one succeeded) or 1000 (both failed)
    # Should NEVER be -200 (both succeeded - race condition!)
    assert final_balance in [400, 1000], "Race condition detected!"

# Stress test with many threads
def stress_test_race_condition():
    account = Account(10000)
    threads = []
    
    def worker():
        for _ in range(100):
            account.withdraw(1)
            time.sleep(0.0001)  # Increase race window
    
    # 10 threads, 100 withdrawals each = 1000 total
    for _ in range(10):
        t = threading.Thread(target=worker)
        threads.append(t)
        t.start()
    
    for t in threads:
        t.join()
    
    expected_balance = 10000 - 1000
    actual_balance = account.get_balance()
    
    print(f"Expected: {expected_balance}, Actual: {actual_balance}")
    assert actual_balance == expected_balance, "Race condition detected!"