Page History

...

The client program runs through the sequence of all possible hash codes using CraftedLicenseType until it successfully matches the hash code of the demo license key object stored in the LicenseManager class. Consequently, within a few minutes the attacker is able to find the sensitive data present within the licenseMap. That is possible by facilitating at least one hash collision with respect to the key of the map.

Compliant Solution

This compliant solution uses an IdentityHashMap instead of HashMap to store the license information.

public class LicenseManager {
    Map<LicenseType, String> licenseMap = new IdentityHashMap<LicenseType, String>();

  // ...
}

According to the Java API API 06

quote

This class implements the Map interface with a hash table, using reference-equality in place of object-equality when comparing keys (and values). In other words, in an IdentityHashMap, two keys k1 and k2 are considered equal if and only if (k1==k2). (In normal Map implementations (like HashMap) two keys k1 and k2 are considered equal if and only if (k1==null ? k2==null : k1.equals(k2)).)

quote

Consequently, the overridden methods cannot expose internal class details. The client program can continue to add license keys and even retrieve the added key-value pairs as demonstrated by the following client code.

public class DemoClient {
    public static void main(String[] args) {
        LicenseManager licenseManager = new LicenseManager();
        LicenseType type = new LicenseType();
        type.setType("custom-license-key");
        licenseManager.setLicenseKey(type, "CUS-TOM-LIC-KEY");
        Object licenseKeyValue = licenseManager.getLicenseKey(type);
        System.out.println(licenseKeyValue);
    }
}

Compliant Solution (final class)

This compliant solution declares the LicenseType class final so that its methods cannot be overridden.

final class LicenseType {
  // ...
} 

Noncompliant Code Example

...