Page History

In a Java Virtual Machine (JVM), a class is identified by its fully qualified class name and its class loader. A class with the same name but a different package name is different, and a class with the same fully qualified name but which has been loaded withby a different class loader is also different. "Two classes are the same class (and consequently the same type) if they are loaded by the same class loader and they have the same fully qualified name". \[[JVMSpec 99|AA. Java References#JVMSpec 99]\].  

Sometimes it is desirable to check whether a given object has a specific class type or whether two objects have the same class type associated with them, for example, while when implementing the equals() method. If the comparison is performed incorrectly, the code might assume that the two objects are of the same class whilst they're not.

Depending on the function that this the insecure code performs, it may be vulnerable to a mix-and-match attack. An attacker can may supply a malicious class with the same name as the target class. If only it is just the class names that are compared to grant access to a critical resource, the malicious class may end up with more privileges than it requires.

...

Noncompliant Code Example

In this This noncompliant code example , the code compares the name of the class of object h to the string DefaultAuthenticationHandler and proceeds according to whether this comparison succeeds or notdepending on the result of the comparison.

 // determineDetermine whether object h has required/expected class name
if (h.getClass().getName().equals("com.application.auth.DefaultAuthenticationHandler")) {
  // ...
}

The problem with this example main issue is that another class may exist with the same name in the JVM.

...

This compliant solution compares the class object of class h to the class object of the class that the current class loader loads, instead of comparing just the class names.

 // determineDetermine whether object h has required/expected class name
if (h.getClass() == this.getClassLoader().loadClass("com.application.auth.DefaultAuthenticationHandler")) {
  // ...
}

...

Noncompliant Code Example

This noncompliant code example compares the names of the class objects of classes x and y using the equals() method and behaves accordingly.

// determineDetermine whether objects x and y have the same class name
if (x.getClass().getName().equals( y.getClass().getName() )) {
  // codeCode assumes that the objects have the same class
}

...

// determineDetermine whether objects x and y have the same class
if (x.getClass() == y.getClass()) {
  // codeCode determines whether the objects have the same class
}

Risk Assessment

Comparison of Comparing classes using their names may give an attacker supplied class undesirable privileges.

...