震惊，99.9% 的同学没有真正理解字符串的不可变性

public final class String
    implements java.io.Serializable, Comparable<String>, CharSequence {
    /** The value is used for character storage. */
    private final char value[];

//省略其他

  public String concat(String str) {
        int otherLen = str.length();
        if (otherLen == 0) {
            return this;
        }
        int len = value.length;
        char buf[] = Arrays.copyOf(value, len + otherLen);
        str.getChars(buf, len);
        return new String(buf, true);
    }

}

String s1 = "明明如月学长";
String s2 = "明明如月学长");
String s3 = new String("明明如月学长");
assertThat(s1 == s2).isTrue();
assertThat(s1 == s3).isFalse();

void criticalMethod(String userName) {
    //1 执行安全检查
    if (!isAlphaNumeric(userName)) {
        throw new SecurityException(); 
    }
	
    //2 执行一些次要的任务
    initializeDatabase();
	
    //3 重要的任务
    connection.executeUpdate("UPDATE Customers SET Status = 'Active' " +
      " WHERE UserName = '" + userName + "'");
}

 /**
     * Returns a hash code for this string. The hash code for a
     * {@code String} object is computed as
     *      * s[0]*31^(n-1) + s[1]*31^(n-2) + ... + s[n-1]
     * 
     * using {@code int} arithmetic, where {@code s[i]} is the
     * ith character of the string, {@code n} is the length of
     * the string, and {@code ^} indicates exponentiation.
     * (The hash value of the empty string is zero.)
     *
     * @return  a hash code value for this object.
     */
    public int hashCode() {
        int h = hash;
        if (h == 0 && value.length > 0) {
            char val[] = value;

            for (int i = 0; i < value.length; i++) {
                h = 31 * h + val[i];
            }
            hash = h;
        }
        return h;
    }

    public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException {
        String name ="明明如月学长 admin";
        System.out.println("name 修改前："+name+", hashCode:"+name.hashCode());
        String newName = "明明如月学长";
        System.out.println("newName："+newName+", hashCode:"+newName.hashCode());
        replace(name,newName);
        System.out.println("name 修改后: "+name+", hashCode:"+name.hashCode());
    }


    private static  void replace(String name,String newName) throws NoSuchFieldException, IllegalAccessException {
    // 去掉私有
        Field value = String.class.getDeclaredField("value");
        value.setAccessible(true);

   // 去掉 final
        Field mod = Field.class.getDeclaredField("modifiers");
        mod.setAccessible(true);
        mod.setInt(value, value.getModifiers() & ~Modifier.FINAL);

       // 直接替换 value 字符数组
        value.set(name, newName.toCharArray());
    }

import java.lang.reflect.Field;
import java.lang.reflect.Modifier;
import java.util.concurrent.TimeUnit;

public class StringDemo {

    public static void main(String[] args) throws InterruptedException {

        String name ="明明如月学长 admin";

        new Thread(()->{
            try {
                mockExecute(name);
            } catch (InterruptedException e) {
                e.printStackTrace();
            }
        }).start();
        TimeUnit.SECONDS.sleep(2);
        new Thread(()->{
            try {
                mockInject(name);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }).start();
        TimeUnit.SECONDS.sleep(10);


    }

private  static synchronized   void mockInject(String name) throws InterruptedException, NoSuchFieldException, IllegalAccessException {
        // sleep 让 子线程执行到 wait
        TimeUnit.SECONDS.sleep(1);

        // 检查前使用合规的名称
        System.out.println("mockInject: 去掉 admin，绕过校验");
        replace(name,"明明如月学长");
        StringDemo.class.notifyAll();
        System.out.println("mockInject: 恢复 admin");
        // 检查后换成不合规的名称
        replace(name,"明明如月学长 admin");
        System.out.println("mockInject: 恢复 admin 完毕");
        StringDemo.class.notifyAll();
    }

private static  void replace(String name,String newName) throws NoSuchFieldException, IllegalAccessException {
        Field value = String.class.getDeclaredField("value");
        value.setAccessible(true);

        Field mod = Field.class.getDeclaredField("modifiers");
        mod.setAccessible(true);
        mod.setInt(value, value.getModifiers() & ~Modifier.FINAL);
        value.set(name, newName.toCharArray());

    }

private static synchronized  void mockExecute(String name) throws InterruptedException {
        System.out.println("mockExecute: [1] name.contains(\"admin\")："+name.contains("admin"));
        StringDemo.class.wait();
        //1 参数检查
        if(name.contains("admin")){
            throw new IllegalArgumentException("参数检查失败");
        }
        System.out.println("mockExecute: 不含 admin 关键字，参数检查通过");
        System.out.println("mockExecute: [2] name.contains(\"admin\")："+name.contains("admin"));
        //2 执行次要任务
        System.out.println("mockExecute: 执行次要任务");

        //3 执行重要人物
        System.out.println("mockExecute: 执行重要任务");
    }
}