CWE-486: Comparison of Classes by Name

Description

The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.

Potential Impact

Integrity: Execute Unauthorized Code or Commands

How to Fix

Implementation

Use class equivalency to determine type. Rather than use the class name to determine if an object is of a given type, use the getClass() method, and == operator.

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-486 vulnerabilities in your codebase.

Get Security Assessment