Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8055299

HttpsURLConnection.equals() broken

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: P3 P3
    • 9
    • None
    • security-libs
    • None
    • 7
    • b29
    • Verified

        there is a major bug with HttpsURLConnection as it breaks
        the contract of equals. So the instance cannot be contained (mostly
        removed) in any collection reliably. (Concurrent)HashMap has a provision to
        test equality by reference prior calling equals, though.
        Finding the bug in production is quite a ride as the http variant doesn't
        exhibit the problem.

        Here is a simple test case.

           public static void main(String[] args) throws Throwable{
             URLConnection c = new URL("https://oracle.com").openConnection();
             System.out.println(c.getClass().getName()+" equals self: "
        +c.equals(c));
             c.getInputStream().close();
             System.out.println(c.getClass().getName()+" equals self: "
        +c.equals(c));
           }


        The culprit is in HttpsURLConnectionImpl.equals that blindly calls
        delagate.equals:

        //// BUG >>>> Not comparing with the delegate
            public boolean equals(Object obj) {
                return delegate.equals(obj);
            }

        It should be changed to:

            public boolean equals(Object obj) {
                return this==obj || (obj instanceof HttpsURLConnectionImpl) &&
        delegate.equals( ((HttpsURLConnectionImpl)obj).delegate );
            }

              michaelm Michael McMahon
              michaelm Michael McMahon
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: