1165
Description
The product compares classes by name, which can cause it to use the wrong class when multiple
classes can have the same name.
Extended Description
If the decision to trust the methods and data of an object is based on the name of a class, it is
possible for malicious users to send objects of the same name as trusted classes and thereby gain
the trust afforded to known classes and types.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1025 Comparison Using Wrong Factors 1868
PeerOf 386 Symbolic Name not Mapping to Correct Object 942
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
If a product relies solely on the name of an object to
determine identity, it may execute the incorrect or
unintended code.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Use class equivalency to determine type. Rather than use the class name to determine if an
object is of a given type, use the getClass() method, and == operator.
Demonstrative Examples
Example 1:
In this example, the expression in the if statement compares the class of the inputClass object to a
trusted class by comparing the class names.
CWE Version 4.14
CWE-486: Comparison of Classes by Name
CWE-486: Comparison of Classes by Name