Protecting Java Code: Canonicalization, Information Disclosure and TOCTOU