[2.x] Avoid ConcurrentModificationException for User class fields (#5084

) Signed-off-by: shikharj05 <[email protected]>
opensearch-project · Feb 4, 2025 · 05e56ec · 05e56ec
1 parent 443c59c
commit 05e56ec
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java b/src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java
@@ -1222,7 +1222,10 @@ private Set<String> map(final User user, final TransportAddress caller) {
                 return Collections.emptySet();
             }
 
-            final Set<String> securityRoles = new HashSet<>(user.getSecurityRoles());
+            final Set<String> securityRoles = new HashSet<>();
+            synchronized (user.getSecurityRoles()) {
+                securityRoles.addAll(user.getSecurityRoles());
+            }
 
             if (rolesMappingResolution == ConfigConstants.RolesMappingResolution.BOTH
                 || rolesMappingResolution == ConfigConstants.RolesMappingResolution.BACKENDROLES_ONLY) {