Function LSParseDateTime() is not thread safe

Description

I just started getting exceptions when I updated my server to the latest Lucee release from v5.1.x to 5.2.4.37. I'm seeing weird exceptions coming through that make no sense at all. For example, the following code occassionally generates the error: For input string: "", which is impossible since the code would never pass the if statement.

<cfif URL.date NEQ "" AND IsValid("USDate", URL.date)>
	<cfset SetLocale("English (US)")>
	<cfset theDate = LSParseDateTime(URL.date)>
</cfif>

After some research, it appears that the java function SimpleDateFormat() is not thread safe. See: https://stackoverflow.com/questions/11368632/multiple-exceptions-thrown-parsing-date-string, and looking at the Lucee source code, LSParseDateTime() calls it.

It also looks like this has been in the Lucee source code since Sep 11, 2015, so this may not be a bug specific to this release.

Environment

Windows Server 2012 R2

Status

Assignee

Michael Offner

Reporter

Sprint

None

Fix versions

5.2.9.10

Affects versions

5.2.4.37

Priority

Critical