Page History

In a JVM, a class is identified by its fully qualified class name _and_ its classloaderClassloader. A class with the same name but a different package name is different, and a class with the same fully qualified name but which has been loaded with a different classloaderClassloader is also different. "Two classes are the _same class_ (and therefore the _same type_) if they are loaded by the same class loader and they have the same fully qualified name" \[JVMSpec 99 §2.8.1\].

You One may frequently want to know whether a given object has a specific class , or whether two objects have the same class, for example, in implementing the equals() method. If the comparison is performed incorrectly, your code might assume that two objects are of the same class when they're not.

Depending on the function that this code performs, this might introduce a vulnerability to a mix-and-match attack. An attacker can supply code that is the same name as your class; if you rely on comparing the classname as a string, you might end up believing it is privileged code and granting it undue privileges.

Conversely, a source of error is assuming the assumption that the same codebase will result in the same class in a JVM is error-prone. While it is usually true in for common user applications, it is not the case with J2EE servers like servlet containers, which could use different instances of classloaders Classloaders to be able to deploy and undeploy recall applications at runtime without restarting the JVM. In this situationsuch situations, two objects whose classes come from the same codebase could be different classes to the JVM, and it could be confusing to get false from the equals() method on their respective classes.

...

 // determine whether object h has required/expected class name
if (h.getClass().getName().equals("com.example.application.auth.DefaultAuthenticationHandler")) {
    // code assumes it's an authorized class
}

The problem with this solution example is that another class could exist with the same name in the same JVM.

Compliant Solution

In this This compliant solution , we compare compares the class object of h itself to the class object of the class that the current class loader would load with our the required name.

 // determine whether object h has required/expected class name
if (h.getClass() == this.getClassLoader().loadClass("com.example.application.auth.DefaultAuthenticationHandler")) {
    // code determines authorized class loaded by same classloader
}

...

 // determine whether objects x and y have same class name
if (x.getClass().getName().equals( y.getClass().getName() )) {
    // code assumes objects have same class
}

...

Compliant Solution

This compliant solution correctly compares the two objects' classes.

 // determine whether objects x and y have same class
if (x.getClass() == y.getClass()) {
    // code determines whether objects have same class
}

...