map.put(entry.getKey(), entry.getValue());
    }
    getMap().putAll(map);
  }

  /**
   * Returns the {@link Method} instance for {@link #testPutAll_nullKeyUnsupported()} so that tests
   * can suppress it with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-5045147">JDK-5045147</a> is fixed.
   */
  @J2ktIncompatible
  @GwtIncompatible // reflection

    if (predicate == null) {
      throw new IllegalArgumentException(
          expectedThrowable
              + " is not yet supported by ReflectionFreeAssertThrows. Add an entry for it in the"
              + " map in that class.");
    }
    Object result;
    try {
      result = supplier.get();
    } catch (Throwable t) {
      if (predicate.apply(t)) {

        for (int i = 0; i < elements.length; i++) {
          String element = elements[i];
          if (multiset1.contains(element) || multiset2.contains(element)) {
            // add to both; the one already containing it will have more
            multiset1.add(element);
            multiset2.add(element);
          } else if (i % 2 == 0) {
            multiset1.add(elements[i]);
          } else {

          </excludePackageNames>
          <!-- Ignore some tags that are found in Java 11 sources but not recognized... under -source 8, I think it was? I can no longer reproduce the failure. -->
          <tags>
            <tag>
              <name>apiNote</name>
              <placement>X</placement>
            </tag>
            <tag>

// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of

그렇게 하면 몇 분 또는 몇 시간 만에, 응답에 걸린 시간만을 이용해(우리 애플리케이션의 “도움”을 받아) 올바른 사용자명과 비밀번호를 추측할 수 있게 됩니다.

#### `secrets.compare_digest()`로 해결하기 { #fix-it-with-secrets-compare-digest }

하지만 우리 코드는 실제로 `secrets.compare_digest()`를 사용하고 있습니다.

요약하면, `stanleyjobsox`와 `stanleyjobson`을 비교하는 데 걸리는 시간은 `johndoe`와 `stanleyjobson`을 비교하는 데 걸리는 시간과 같아집니다. 비밀번호도 마찬가지입니다.

    }.also { expected ->
      assertThat(expected).hasMessage("expected at least 1 part")
    }
  }

  @Test fun `skip preamble`() {
    val multipart =
      """
      |this is the preamble! it is invisible to application code
      |
      |--simple boundary
      |
      |abcd
      |--simple boundary--
      """.trimMargin()
        .replace("\n", "\r\n")

    val parts =

   * has consumed the entire input and they are ready to output a {@code HashCode}. The order of the
   * hashers are the same order as the functions given to the constructor.
   */
  // this could be cleaner if it passed HashCode[], but that would create yet another array...
  /* protected */ abstract HashCode makeHash(Hasher[] hashers);

  @Override
  public Hasher newHasher() {
    Hasher[] hashers = new Hasher[functions.length];

#### **专业**攻击 { #a-professional-attack }

当然，攻击者不用手动操作，而是编写每秒能执行成千上万次测试的攻击程序，每次都会找到更多正确字符。

但是，在您的应用的**帮助**下，攻击者利用时间差，就能在几分钟或几小时内，以这种方式猜出正确的用户名和密码。

#### 使用 `secrets.compare_digest()` 修补 { #fix-it-with-secrets-compare-digest }

在此，代码中使用了 `secrets.compare_digest()`。

简单的说，它使用相同的时间对比 `stanleyjobsox` 和 `stanleyjobson`，还有 `johndoe` 和 `stanleyjobson`。对比密码时也一样。

在代码中使用 `secrets.compare_digest()` ，就可以安全地防御这整类安全攻击。

  }

  /**
   * Returns the {@link Method} instance for {@link #testToArray_isPlainObjectArray()} so that tests
   * of {@link Arrays#asList(Object[])} can suppress it with {@code
   * FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6260652">JDK-6260652</a> is fixed.
   */
  @J2ktIncompatible
  @GwtIncompatible // reflection