[maven-4.0.x] DefaultModelBuilder: thread-unsafe HashSet inside ConcurrentHashMap

[elharo]

DefaultModelBuilder: Thread-unsafe HashSet inside ConcurrentHashMap

Found in: maven-4.0.x branch
File: impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java (lines 454-457)
Severity: High

Description

mappedSources is a ConcurrentHashMap<GAKey, Set<ModelSource>>. While computeIfAbsent is atomic for the map, the returned HashSet values are shared across threads and are NOT thread-safe:

public void putSource(String groupId, String artifactId, ModelSource source) {
    mappedSources
            .computeIfAbsent(new GAKey(groupId, artifactId), k -> new HashSet<>())
            .add(source);
}

If multiple threads concurrently add sources for the same GAKey, the internal structure of the HashSet can become corrupted (lost updates, infinite loops during iteration, etc.). This is exercisable during parallel reactor builds where loadFilePom calls putSource from within executor tasks running concurrently.

[goutamadwant]

@elharo I prepared a fix #12766 that stores mapped sources in a concurrent key set. Pls review and let me know if there are any suggestions or comments. thanks!