The program compares classes by name, which can cause it to use
the wrong class when multiple classes can have the same
name.
Extended Description
If the decision to trust the methods and data of an object is based on the
name of a class, it is possible for malicious users to send objects of the
same name as trusted classes and thereby gain the trust afforded to known
classes and types.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Authorization
If a program relies solely on the name of an object to determine
identity, it may execute the incorrect or unintended code.
Likelihood of Exploit
High
Demonstrative Examples
Example 1
(Bad Code)
Java
if (inputClass.getClass().getName().equals("TrustedClassName"))
{
// Do something assuming you trust inputClass
// ...
}
Potential Mitigations
Phase
Description
Implementation
Use class equivalency to determine type. Rather than use the class
name to determine if an object is of a given type, use the getClass()
method, and == operator.
Description
