Skip to content

Instantly share code, notes, and snippets.

@codelion
Forked from jsyeo/Main.java
Last active August 27, 2015 00:34
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save codelion/f5fcd43d26f55b4550b4 to your computer and use it in GitHub Desktop.
Save codelion/f5fcd43d26f55b4550b4 to your computer and use it in GitHub Desktop.
Object Equals
public class Main {
public static void main(String[] args) {
VulnerableClass a = new VulnerableClass(1);
VulnerableClass b = new VulnerableClass(2);
a.equals(b);
HarmlessClass ha = new HarmlessClass(1);
HarmlessClass hb = new HarmlessClass(2);
ha.equals(hb);
Object oa = new VulnerableClass(1);
Object ob = new VulnerableClass(2);
oa.equals(ob);
// Object.equals() -> VulnerableClass.equals()
// Object.equals() -> HarmlessClass.equals()
Object oha = new HarmlessClass(1);
Object ohb = new HarmlessClass(2);
oha.equals(ohb);
}
}
class VulnerableClass {
int i;
public VulnerableClass(int i) {
this.i = i;
}
private void vulnerableMethod() {
}
@Override
public boolean equals(Object obj) {
// I am vulnerable
vulnerableMethod();
return i == ((VulnerableClass) obj).i;
}
}
class HarmlessClass {
@Override
public boolean equals(Object obj) {
return super.equals(obj); // HarmlessClass.equals() -> Object.equals()
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment