java.util.ConcurrentModificationException when iterating over ((SOAPMessageContext) mc).getMessage().getMimeHeaders().getAllHeaders()

Question

I have a

public class LoggingHandler implements SOAPHandler<SOAPMessageContext> {

and in the

public boolean handleMessage(SOAPMessageContext context)

I have the below processing of the message headers

            LOGGER.trace("Starting processing msg in try block");
            SOAPMessage msg = ((SOAPMessageContext) mc).getMessage();
            LOGGER.trace("Cast message and getting message");
            MimeHeaders mimeHeaders = msg.getMimeHeaders();
            LOGGER.trace("Getting headers");
            Iterator mhIterator = mimeHeaders.getAllHeaders();
            LOGGER.trace("Starting file creation for user {}", user); //not actually affecting the SOAP message, but needed according to my business logic
            msg.writeTo(baos);
            FileWriter fw = new FileWriter(filename, true);
            BufferedWriter bw = new BufferedWriter(fw);
            PrintWriter out = new PrintWriter(bw);
            LOGGER.trace("File opened for filename {}", filename);
            LOGGER.trace(type);
            //out.println(type);
            //out.flush();
            while (mhIterator.hasNext()) {
                LOGGER.trace("Iterator loop started");
                MimeHeader mh = (MimeHeader) mhIterator.next();
                LOGGER.trace("Iterator next requested");
                String header = mh.getName() + " : " + mh.getValue();
                LOGGER.trace("Iterator MimeHeared values taken");
                LOGGER.trace(header);
                out.print(formattedDateTime+Thread.currentThread().getId()+" "+(outboundProperty?"Request":"Response")+" "+user+" "+header+"\r\n");
                out.flush();
            }

So,

LOGGER.trace("Iterator loop started"); 

works, but

MimeHeader mh = (MimeHeader) mhIterator.next();

already hangs and fails with below exception. For me it isn't clear, as I don't touch the data being iterated.

2022-10-26 19:25:48.595 [http-nio-127.0.0.1-8080-exec-6] ERROR c.o.s.w.s.i.WebServiceExceptionHandler - java.util.ConcurrentModificationException
javax.xml.ws.WebServiceException: java.util.ConcurrentModificationException
        at com.sun.xml.ws.handler.ClientSOAPHandlerTube.callHandlersOnRequest(ClientSOAPHandlerTube.java:120)
        at com.sun.xml.ws.handler.HandlerTube.processRequest(HandlerTube.java:97)
        at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:1106)
        at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:1020)
        at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:989)
        at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:847)
        at com.sun.xml.ws.client.Stub.process(Stub.java:433)
        at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:161)
        at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:78)
        at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:62)
        at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:131)
        at com.sun.proxy.$Proxy543.getUserInfo(Unknown Source)
        at com.openpayment.client.basia.BankServiceClientImpl.getUserInfo(BankServiceClientImpl.java:47)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.aop.framework.adapter.AfterReturningAdviceInterceptor.invoke(AfterReturningAdviceInterceptor.java:55)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168)
        at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:96)
        at com.openpayment.client.basia.handler.error.LoggingFilterAspect.putToLogOn(LoggingFilterAspect.java:38)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:627)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:616)
        at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
        at com.sun.proxy.$Proxy94.getUserInfo(Unknown Source)
        at com.openpayment.impl.service.AgentServiceImpl.createOrUpdateAgent(AgentServiceImpl.java:597)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:283)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
        at com.sun.proxy.$Proxy105.createOrUpdateAgent(Unknown Source)
        at com.openpayment.site.web.service.UserResource.createOrUpdateUser(UserResource.java:75)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:854)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:765)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
        at com.openpayment.site.web.service.init.SiteWebDispatcherServlet.doDispatch(SiteWebDispatcherServlet.java:48)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:681)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:228)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:163)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:190)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:163)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:190)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:163)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:382)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1723)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.util.ConcurrentModificationException: null
        at java.base/java.util.Vector$Itr.checkForComodification(Vector.java:1321)
        at java.base/java.util.Vector$Itr.next(Vector.java:1277)
        at com.openpayment.client.basia.handler.LoggingHandler.logMessage(LoggingHandler.java:108)
        at com.openpayment.client.basia.handler.LoggingHandler.handleMessage(LoggingHandler.java:49)
        at com.openpayment.client.basia.handler.LoggingHandler.handleMessage(LoggingHandler.java:26)
        at com.sun.xml.ws.handler.HandlerProcessor.callHandleMessage(HandlerProcessor.java:267)
        at com.sun.xml.ws.handler.HandlerProcessor.callHandlersRequest(HandlerProcessor.java:108)
        at com.sun.xml.ws.handler.ClientSOAPHandlerTube.callHandlersOnRequest(ClientSOAPHandlerTube.java:112)
        ... 124 common frames omitted

By the end, the full class is given, the iterator causiong a problem is commented out:

package com.openpayment.client.basia.handler;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;

import javax.xml.bind.DatatypeConverter;
import javax.xml.namespace.QName;
import javax.xml.soap.MimeHeader;
import javax.xml.soap.MimeHeaders;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPMessage;
import javax.xml.ws.handler.MessageContext;
import javax.xml.ws.handler.soap.SOAPHandler;
import javax.xml.ws.handler.soap.SOAPMessageContext;
import java.io.*;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Collections;
import java.util.Date;
import java.util.Iterator;
import java.util.Set;

public class LoggingHandler implements SOAPHandler<SOAPMessageContext> {
    private static final Logger LOGGER = LoggerFactory.getLogger(LoggingHandler.class);

    private String tempLogfilesLocation;

    private String user;
    private Boolean toLog;

    public LoggingHandler(String user, Boolean toLog, String tempLogfilesLocation) {
        this.user = user;
        this.toLog = toLog;
        this.tempLogfilesLocation = tempLogfilesLocation;
    }

    public void close(MessageContext context) {
    }

    public boolean handleFault(SOAPMessageContext context) {
        logMessage(context, "SOAP Error is : ");
        return true;
    }

    public boolean handleMessage(SOAPMessageContext context) {
        logMessage(context, "SOAP Message: ");
        return true;
    }

    public Set<QName> getHeaders() {
        return Collections.emptySet();
    }

    private boolean logMessage(MessageContext mc, String type) {
        // try {
        MessageDigest md = null;
        try {
            md = MessageDigest.getInstance("MD5");
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        }
        LOGGER.trace("Hanldler User {}", user);
        LOGGER.trace("Handler toLog {}", toLog);
        LOGGER.trace("Handler tempLogfilesLocation {}", tempLogfilesLocation);
        md.update(user.getBytes());
        LOGGER.trace("md updated");
        byte[] digest = md.digest();
        LOGGER.trace("digest calculated");
        String usernameHash = DatatypeConverter.printHexBinary(digest).toUpperCase();
        LOGGER.trace("userhashname {} of user {}", usernameHash, user);
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        LOGGER.trace("Outputstream created");
        String filename = tempLogfilesLocation + usernameHash + ".log";
        LOGGER.trace("Starting processing msg {}", mc.toString());
        if (toLog == null) {
            this.toLog = false;
        }
        LocalDateTime printDate = LocalDateTime.now();
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS ");
        String formattedDateTime = printDate.format(formatter); // "1986-04-08 12:30"

        Boolean outboundProperty = (Boolean) mc.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);

        if (toLog) { //if username is present for the SOAP query; it use to be present, so we rely on that!
            LOGGER.trace("Starting processing msg before try block");
            try {
                LOGGER.trace("Starting processing msg in try block");
                SOAPMessage msg = ((SOAPMessageContext) mc).getMessage();
                LOGGER.trace("Cast message and getting message");
                MimeHeaders mimeHeaders = msg.getMimeHeaders();
                LOGGER.trace("Getting headers");
                Iterator mhIterator = mimeHeaders.getAllHeaders();

                LOGGER.trace("Starting file creation for user {}", user);
                msg.writeTo(baos);
                FileWriter fw = new FileWriter(filename, true);
                BufferedWriter bw = new BufferedWriter(fw);
                PrintWriter out = new PrintWriter(bw);
                LOGGER.trace("File opened for filename {}", filename);
                LOGGER.trace(type);
                //out.println(type);
                //out.flush();
//                while (mhIterator.hasNext()) {
//                    LOGGER.trace("Iterator loop started");
//                    MimeHeader mh = (MimeHeader) mhIterator.next();
//                    LOGGER.trace("Iterator next requested");
//                    String header = mh.getName() + " : " + mh.getValue();
//                    LOGGER.trace("Iterator MimeHeared values taken");
//                    LOGGER.trace(header);
//                    out.print(formattedDateTime+Thread.currentThread().getId()+" "+(outboundProperty?"Request":"Response")+" "+user+" "+header+"\r\n");
//                    out.flush();
//                }
                LOGGER.trace(" " + simpleSecureFilter(baos.toString()));
                out.print(formattedDateTime+Thread.currentThread().getId()+" "+(outboundProperty?"Request":"Response")+" "+user+" "+simpleSecureFilter(baos.toString())+"\r\n");
                out.flush();
                out.close();
                baos.close();
                LOGGER.trace("SOAP Message has been written to the file {}", filename);

            } catch (IOException e) {
                LOGGER.error("Error logging SOAP message to file " + filename + " for user " + user, e);
            } catch (SOAPException e) {
                LOGGER.trace("Starting file creation for catching soap exceptions for user {}", user);
                FileWriter fw = null;
                try {
                    fw = new FileWriter(filename, true);
                    BufferedWriter bw = new BufferedWriter(fw);
                    PrintWriter out = new PrintWriter(bw);
                    out.println(e.getMessage());
                    LOGGER.error("Soap Exception", e);
                } catch (IOException ex) {
                    LOGGER.error("Exception when trying to write tio the file SOAP fault", ex);
                    throw new RuntimeException(ex);
                }
            }
        }
        else {
            LOGGER.trace("Else block for toLog {}", toLog);
        }
        LOGGER.trace("Call ended");

        return true;
    }

    private String simpleSecureFilter(String input) {
        String[] secureTags = new String[]{"password", "pNewPass"};
        for (String secureTag : secureTags) {
            int startIndex = input.indexOf(secureTag + ">");
            if (startIndex != -1) {
                int endIndex = input.substring(startIndex).indexOf("</");
                String password = input.substring(startIndex + secureTag.length() + 1, startIndex + endIndex);
                return input.replaceAll(secureTag + ">" + password + "</", secureTag + ">***</");
            }
        }
        return input;
    }
}