From e01e5cf90ea961f0fa8464ae12e3a4d05a070da1 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 2 Apr 2026 07:48:58 +0000 Subject: [PATCH] fix: eliminate race condition in buildDSLDependency() for @-namespaced DSL Mutating the shared cached definition struct (arguments.definition.dsl) under concurrent load caused double-concatenation and mis-wiring when multiple threads resolved the same @-namespaced injection simultaneously (e.g. inject="myService@moduleName"). Instead of writing back to the shared struct, call getInstance() directly with the locally-computed concatenated name. The @-prefixed branch in getModelDSL() always resolves to a plain getInstance() call (no colons possible), so this is behaviourally identical but fully thread-safe. https://claude.ai/code/session_015kUgi5MyDwtH2FWf5u5DDN --- system/ioc/Builder.cfc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/system/ioc/Builder.cfc b/system/ioc/Builder.cfc index c29aa2670..06290ca63 100644 --- a/system/ioc/Builder.cfc +++ b/system/ioc/Builder.cfc @@ -678,9 +678,10 @@ component serializable="false" accessors="true" { // If no DSL's found, let's try to use the name as the empty namespace default: { if ( len( DSLNamespace ) && left( DSLNamespace, 1 ) == "@" ) { - arguments.definition.dsl = arguments.definition.name & arguments.definition.dsl; + refLocal.dependency = variables.injector.getInstance( arguments.definition.name & arguments.definition.dsl ); + } else { + refLocal.dependency = getModelDSL( argumentCollection = arguments ); } - refLocal.dependency = getModelDSL( argumentCollection = arguments ); } }