Page History

Arrays do not override the Object.equals() method; the implementation of the equals() method compares array references rather than their contents. Programs Programmers who wish to compare the contents of two arrays must use the twothe two-argument Arrays.equals() method to compare the contents of two arrays. Programs must .  Two arrays are considered equal if both arrays contain the same number of elements, and all corresponding pairs of elements in the two arrays are equal.  In other words, two arrays are equal if they contain the same elements in the same order.  To test for reference equality, programmers can use the reference equality operators, == and !=, when intentionally testing reference equality..  Because the effect of using Object.equals() to compare two arrays is often misunderstood, and because a better alternative exists in the use of reference equality operators, the use of the Object.equals() method to compare two arrays is disallowed by this rule.

Noncompliant Code Example

This noncompliant code example incorrectly uses the Object.equals() method to compare two arrays.

public void arrayEqualsExamplearraysEqual() {
  int[] arr1 = new int[20]; // initialized to 0
  int[] arr2 = new int[20]; // initialized to 0
  arr1.equals(arr2); // false
}

Compliant Solution

This compliant solution compares the two content of two arrays using the two-argument Arrays.equals() method.

public void arrayEqualsExamplearrayContentsEqual() {
  int[] arr1 = new int[20]; // initialized to 0
  int[] arr2 = new int[20]; // initialized to 0
  Arrays.equals(arr1, arr2); // true
}

Compliant Solution

This compliant solution compares the array references using the reference equality operators ==.

public void arrayReferencesEqual(int[] arr1, int[] arr2) {
  arr1 = arr2; 
}

Risk Assessment

Using the equals() method or relational operators with the intention of comparing array contents produces incorrect results, which can lead to vulnerabilities.

Automated Detection

Static detection of calls to to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.Also, it is not possible to determine whether or not use of reference equality (operators == and !=) is intentional.

Related Guidelines

Bibliography

...

EXP01-J. Never dereference null pointers      02. Expressions (EXP)