...
Comparing classes solely using their names can allow a malicious class to bypass security checks and gain access to protected resources.
Remediation CostDetectable | Repairable | Priority | Level |
|---|
OBJ09-J | High | Unlikely | Yes |
LowP9 Automated Detection
| Tool | Version | Checker | Description |
|---|
| The Checker Framework | | Include Page |
|---|
| The Checker Framework_V |
|---|
| The Checker Framework_V |
|---|
|
| Signature String Checker | Ensure that the string representation of a type is properly used for example in Class.forName (see Chapter 13) |
CodeSonarCodeSonarCodeSonarFB.CORRECTNESS.EQ_COMPARING_CLASS_NAMES
| equals method compares class names rather than class objectsSECURITYEABImplemented Related Guidelines
Bibliography
...
...
