...
Using the equals() method or relational operators with the intention of comparing array contents produces incorrect results, which can lead to vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP02-J | Low | Likely | Low | P9 | L2 |
Automated Detection
Static detection of calls to to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| FB.CORRECTNESS.EC_BAD_ARRAY_COMPARE | Invocation of equals() on an array, which is equivalent to == | ||||||
| Coverity | 7.5 | BAD_EQ | Implemented | ||||||
| Parasoft Jtest |
|
|
| PB.CUB.UEIC |
| SonarQube |
|
|
| S2159 |
| Silly equality checks should not be made |
Related Guidelines
Bibliography
...