Page History

Java defines equality operators == and != and relational operators such as <=,>=,>,<. When it comes to String object reference comparisons, these manifest as traps that an amateur programmer may unintentionally fall victim to.

Noncompliant Code Example

For == to return true for two String references, they must point to the same underlying object. This noncompliant example declares two different String objects with the same values, however, they compare unequal because they constitute different object references.

public class BadComparison {
  public static void main(String[] args) {
    String one = new String("one");
    String two = new String("one");
    if(one == two)
      System.out.println("Equal"); //not printed
  }
}

Compliant Solution

To be compliant, use the object1.equals(object2) method when comparing string values.

...

NOte that the mentioned operators work when dealing with string literals that have constant values (such as in String one = "one" and String two = "two". or when the intern method has been used on both strings to compare pointer references. (See Compliant Solution 2)

Compliant Solution

If it is desired to keep only one copy of the string in memory, perform quick repeated comparisons and ensure that string1.equals(string2) is true, the following Compliant Solution may be used.

...

However, note that the performance gains achieved by doing so may be meeker than the benefits of having more robust code that also takes non-constant and non-interned values. Moreover, the use of constant and interned values encourages ambiguity that hinders selection of proper methods for comparing String objects.

Exceptions

*EXP03:* In general, for any two objects, it is permissible to compare their elements provided that the class is a singleton. The use of static factory methods over constructors facilitates instance control which in turn limits the effective number of instances of an immutable class to one. As a result, for two objects {{a}} and {{b}}, {{a.equals(b)}} is {{true}} when {{a == b}} \[[Bloch 08|AA. Java References#Bloch 08]\]. The {{String}} class does not meet these requirements and consequently, does not possess these characteristics.

Risk Assessment

Using the equality or relational operators to compare objects can lead to unexpected results.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] [Section 3.10.5, String Literals|http://java.sun.com/docs/books/jls/third_edition/html/lexical.html#3.10.5]
\[[FindBugs 08|AA. Java References#FindBugs 08]\] ES: Comparison of String objects using == or \!=
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 595|http://cwe.mitre.org/data/definitions/595.html] "Incorrect Syntactic Object Comparison", [CWE ID 597|http://cwe.mitre.org/data/definitions/597.html] "Use of Wrong Operator in String Comparison"

...