CWE-597: Use of Wrong Operator in String Comparison
Weakness ID: 597
Abstraction: Variant
Status: Draft
Presentation Filter:
Description
Description Summary
The product uses the wrong operator when comparing a string, such as using "==" when the equals() method should be used instead.
Extended Description
In Java, using == or != to compare two strings for equality actually compares two objects for equality, not their values. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, it could be leveraged to affect program security.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Other
Technical Impact: Other
Demonstrative Examples
Example 1
In the example below, two Java String objects are declared and
initialized with the same string values and an if statement is used to
determine if the strings are equivalent.
(Bad Code)
Example
Language: Java
String str1 = new String("Hello");
String str2 = new String("Hello");
if (str1 == str2) {
System.out.println("str1 == str2");
}
However, the if statement will not be executed as the strings are
compared using the "==" operator. For Java objects, such as String
objects, the "==" operator compares object references, not object
values. While the two String objects above contain the same string
values, they refer to different object references, so the
System.out.println statement will not be executed. To compare object
values, the previous code could be modified to use the equals
method:
Do not use the equality operators when comparing values of
boxed primitives
CERT Java Secure Coding
EXP03-J
Do not use the equality operators when comparing values of
boxed primitives
Software Fault Patterns
SFP1
Glitch in computation
References
[REF-7] Mark Dowd, John McDonald
and Justin Schuh. "The Art of Software Security Assessment". Chapter 6, "Typos", Page 289.. 1st Edition. Addison Wesley. 2006.
More information is available — Please select a different filter.
Page Last Updated:
May 05, 2017
Use of the Common Weakness Enumeration and the associated references from this website are subject to the
Terms of Use. For more information, please email
cwe@mitre.org.
Description
