Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Autoboxing can Autoboxing can automatically wrap the primitive type to the corresponding wrapper object, which can be convenient in many cases and avoid clutters in your own code. But you should always be always be careful about this process, especially when comparison. Section 5.1.7 of JLS 3rd Ed can explain this point clearly:

"If the value p being boxed is true, false, a byte, a char in the range \u0000 to \u007f, or an int or short number between -128 and 127, then let r1 and r2 be the results of any two boxing conversions of p. It is always the case that r1 == r2."

Consider the following code:

Noncompliant code Example

Noncompliant code Example

This code uses "==" to compare 2 Integer object, from EXP03-J we can know that for "==" to return true for two object references, they must point to the same underlying object. So we can simply draw the conclusion that the results of using "==" operator in this code will be false. However,

code
Code Block
bgColor#FFCCCC
public class TestWrapper2 {
 public static void main(String[] args) {
  
  Integer i1 = 100;
     Integer i2 = 100;
     Integer i3 = 1000;
     Integer i4 = 1000;
     System.out.println(i1==i2);
     System.out.println(i1!=i2);
     System.out.println(i3==i4);
     System.out.println(i3!=i4);
    
 }
}

This code uses "==" to compare 2 Integer object, from EXP03-J we can know that for "==" to return true for two object references, they must point to the same underlying object. So we can simply draw the conclusion that the results of using "==" operator in this code will be false. However, 

Output of this code  code

...


true
false
false
true

Here the Here the cache in the Integer class can only class can only make the number from -127 to 128 refer to the same object, which clearly explains the result of result of above code.   In In case of making such mistakes, when we need to do some comparisons of these wrapper class, we should use equal instead "==" (see EXP03-J for details):

...

Code Block

true
false
false
true

Compliant Solution

Using object1.equals(object2) only compares their values. Now, the results will be true, as we expected.

Code Block
bgColor#CCCCFF
public class TestWrapper2 {
 public static void main(String[] args) {
  
  Integer i1 = 100;
     Integer i2 = 100;
     Integer i3 = 1000;
     Integer i4 = 1000;
     System.out.println(i1.equals(i2));
     System.out.println(i3.equals(i4));    
 }
} 

...

Noncompliant Code Example

In many times, you may want to create a dynamic array of integers. Unfortunately, the type parameter inside the angle brackets cannot be a primitive type. It is not possible to form an ArrayList<int>. Thanks to the wrapper class, now you can use ArrayList<Integer> to achieve this goal.  

Code Block
bgColor#FFCCCC
import java.util.ArrayList;
public class TestWrapper1 {
 public static void main(String[] args) {
  //create an array list of integers, which each element
  //is more than 127
     ArrayList<Integer> list1 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list1.add(i+1000);
  //create another array list of integers, which each element
  //is the same with the first one
     ArrayList<Integer> list2 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list2.add(i+1000);    
        
     int counter = 0;
     for(int i=0;i<10;i++)
      if(list1.get(i) == list2.get(i)) counter++;
     //output the total equal number
     System.out.println(counter);
 }
} 

In JDK 1.6.0_10, the output of this code is 0. In this code, we want to count the same numbers of array list1 and array list2. Undoubtedly, the result is result is not the same as our as our expectation. Owning to the fact that the Integer can only caches from -127 to 128, so when int number beyond this range, it will it will be autoboxed into different objects, then the "==" will return false.  But if we But if we can set more caches inside Integer (cache all the integer value (-32K-32K), which means that all the int value could be autoboxed to the same Integer object)  then the then the result may be different!

Compliant solution

Code Block
bgColor#CCCCFF
public class TestWrapper1 {
 public static void main(String[] args) {
  //create an array list of integers, which each element
  //is more than 127
     ArrayList<Integer> list1 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list1.add(i+1000);
  //create another array list of integers, which each element
  //is the same with the first one
     ArrayList<Integer> list2 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list2.add(i+1000);    
        
     int counter = 0;
     for(int i=0;i<10;i++)
      if(list1.get(i).equals(list2.get(i))) counter++;
     //output the total equal number
     System.out.println(counter);
 }
}

...

We often use array list with primitive type, so it will exert  exert a potential security risk.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

EXP05-J

medium

likely

low

P9

L2

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Chapter 5, Core Java™ 2 Volume I - Fundamentals, Seventh Edition by Cay SCay S.  HorstmannHorstmann, Gary Cornell Gary Cornell
Publisher:Prentice Hall PTR;Pub Date:August 17, 2004.
Section 5.1.7, The Java™ Language Specification,Third Edition by James Gosling, Bill Joy, Guy Steele, Gilad Bracha
Publisher:ADDISON-WESLEY;Pub Date:May 2005.