If you know me, you know my perspective on testing. I like to have unit tests for code and I try to write them whenever I can. At times, though, it becomes pretty obvious to me that library designers don't share that interest because they seem to do everything that they can to make testing impossible. Their most common approach is to make classes and methods final or sealed.

Why would this be a problem? Well it's not a problem for the classes that use final, but try to unit test a class which uses one of those classes and you'll see what the trouble is. If the test for your class needs to mock out the use of that final class, your back is against the wall. All you can really do is wrap the final class in some non-final adapter. And, if you do that, well, how's security going? If you use your wrapper pervasively it's the vulnerable point now.

No, there's a measure of security when you use final but only if you imagine that your users aren't really writing unit tests for their code.

Isn't it ironic that we may be able to have secure software, but only if we can't be sure that it actually works?

package trojanattack;
 
import java.util.*;
import static java.lang.System.*;
 
/* Check method would in practice grant something useful, like write permission.
 * But in the example it simply return true or false. */
class Security {
    /* The argument type is a mistake. Should have used String because String is
     * final and therefore can't be a trojan if run with a security manager. */
    static boolean check( final CharSequence pwd ) {
        return (pwd != null) && (pwd.length() == 3) &&
                (pwd.charAt( 0 ) == 'A') && (pwd.charAt( 1 ) == 'B') &&
                (pwd.charAt( 2 ) == 'C');
    }
}
 
/* Logs what the security check does, thus aiding cracking the password.
 * Reduces search from approx. O(27^n) to O(27 * n)! 27 because 26 letters
 * plus empty (password not that long). */
class Trojan implements CharSequence {
    final List< Character > pwd = new ArrayList< Character >();
    int charAtLog = 0;
    public CharSequence subSequence( final int notUsed, final int notUsed2 ) {
        throw new AssertionError();
    }
    public int length() { return pwd.size(); }
    public char charAt( final int index ) {
        charAtLog++;
        return pwd.get( index );
    }
}
 
public class Attack {
    static final char[] all = { 'A', 'B', 'C', 'D', 'E' }; // etc.
    public static void main( final String[] notUsed ) {
        final Trojan t = new Trojan();
        attack: {
            while ( t.charAtLog == 0 ) { // find pwd len
                t.pwd.add( '*' ); // lengthen pwd; any impossible char, it is over written!
                Security.check( t ); // spy on the security
            }
            for ( int index = 0; ; index++ ) { // find pwd
                for ( final char c : all ) {
                    t.pwd.set( index, c );
                    t.charAtLog = 0;
                    if ( Security.check( t ) ) { break attack; } // found pwd
                    if ( t.charAtLog == (index + 2) ) { break; } // found a character in pwd
                }
            }
        }
        out.println( "Cracked :), pwd = " + t.pwd );
    }
}