Page History

In a JVM, a class is identified by its fully qualified class name and its Classloaderclass loader. A class with the same name but a different package name is different, and a class with the same fully qualified name but which has been loaded with a different class Classloaderloader is also different. "Two classes are the same class (and consequently the same type) if they are loaded by the same class loader and they have the same fully qualified name". \[[JVMSpec 99|AA. Java References#JVMSpec 99]\] [§2.8.1 Class Names|http://java.sun.com/docs/books/jvms/second_edition/html/Concepts.doc.html].

Sometimes it is desirable to check One may frequently want to know whether a given object has a specific class type or whether two objects have the same class type associated with them, for example, in while implementing the equals() method. If the comparison is performed incorrectly, your the code might assume that the two objects are of the same class when whilst they're not.

Depending on the function that this code performs, this might introduce a vulnerability it may be vulnerable to a mix-and-match attack. An attacker can supply code that is a malicious class with the same name as your class; if you rely on comparing the classname as a string, you might end up believing it is privileged code and granting it undue privilegesthe target class. If only the class names are compared to grant access to a critical resource, the malicious class may end up with more privileges than it requires.

Conversely, the assumption that the same codebase will result in the same class in a JVM is error-prone. While it is usually true for common user applications, it the misleading assumption is commonly observed to be true in desktop applications, typically this is not the case with J2EE servers like servlet containers, which could containers. The containers may use different class loader instances of Classloaders to be able to deploy and recall applications at runtime, without restarting having to restart the JVM. In such situations, two objects, whose classes come from the same codebase could be different classes , may appear to the JVM , and it could be confusing to get false from to be two different classes. Also note that the equals() method on their respective classesmay not return true when comparing objects originating from the same codebase.

Noncompliant Code Example

In this noncompliant code example, the code compares the name of the class of object h to the string DefaultAuthenticationHandler and proceeds according to whether this comparison succeeds or not.

 // determine whether object h has required/expected class name
if (h.getClass().getName().equals("com.example.application.auth.DefaultAuthenticationHandler")) {
    // code assumes it's an authorized class...
}

The problem with this example is that another class could may exist with the same name in the same JVM.

Compliant Solution

This compliant solution compares the class object of class h itself to the class object of the class that the current class loader would load with the required nameloads instead of comparing just the class names.

 // determine whether object h has required/expected class name
if (h.getClass() == this.getClassLoader().loadClass("com.example.application.auth.DefaultAuthenticationHandler")) {
  // code determines authorized class loaded by same classloader...
}

The call to loadClass() returns the class having the specified name in the current namespace (of the classloader), and the comparison is correctly performed on the two class objects.

Noncompliant Code Example

This code compares the names of the two class objects of classes of objects x and y using the equals() method and behaves accordingly.

 // determine whether objects x and y have the same class name
if (x.getClass().getName().equals( y.getClass().getName() )) {
    // code assumes that the objects have the same class
}

Compliant Solution

This compliant solution correctly compares the two objects' classes.

 // determine whether objects x and y have the same class
if (x.getClass() == y.getClass()) {
    // code determines whether the objects have the same class
}

...

...

The class objects will only be equal when they have the same class as defined in \[[JVMSpec 99|AA. Java References#JVMSpec 99]\] and repeated above.

Risk Assessment

Incorrectly comparing Comparison of classes using their names could may give an attacker 's supplied class undesirable privileges.

...