Page History

Arrays do not override class Object's equals() method; the implementation of the equals() method applied to arrays compares the array references rather than the contents of the arrays. Use the In Java, arrays are objects and support object methods such as Object.equals(). However, arrays do not support any methods besides those provided by Object. Consequently, using Object.equals() on any array compares only array references, not their contents. Programmers who wish to compare the contents of two arrays must use the static two-argument Arrays.equals() method to compare the contents of arrays. When intentionally testing method. This method considers two arrays equivalent if both arrays contain the same number of elements, and all corresponding pairs of elements in the two arrays are equivalent, according to Object.equals(). In other words, two arrays are equal if they contain equivalent elements in the same order. To test for reference equality, use the reference equality operators, == and !=; inappropriate .  

Because the effect of using Object.equals() to compare two arrays is often misconstrued as content equality, and because a better alternative exists in the use of reference equality operators, the use of the Object.equals() method may lead to unexpected resultsto compare two arrays is disallowed.

Noncompliant Code Example

This noncompliant code example incorrectly uses the Object.equals() method to compare two arrays.:

int[] arr1 = new int[20]; // initializedInitialized to 0
int[] arr2 = new int[20]; // initializedInitialized to 0
System.out.println(arr1.equals(arr2)); // Prints false

Compliant Solution

This compliant solution compares the two content of two arrays using the two-argument Arrays.equals() method.:

int[] arr1 = new int[20]; // initializedInitialized to 0
int[] arr2 = new int[20]; // initializedInitialized to 0
System.out.println(Arrays.equals(arr1, arr2)); // Prints true

Compliant Solution

This compliant solution compares the array references using the reference equality operators ==:

int[] arr1 = new int[20]; // Initialized to 0
int[] arr2 = new int[20]; // Initialized to 0
System.out.println(arr1 == arr2); // Prints false 

Risk Assessment

Using the equals() method or relational operators with the intention of comparing array contents produces incorrect results, which can lead to vulnerabilities.

Automated Detection

The Coverity Prevent Version 5.0 BAD_EQ checker can detect the instance where the "==" operator is being used for equality of objects when, ideally, the equal method should have been used. The "==" operator could consider objects different when the equals method considers them the same.

Static detection of attempts to use array_object.equals(...) appears to be straightforward.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[API 2006|AA. Bibliography#API 06]\] [Class {{Arrays}}|http://download.oracle.com/javase/6/docs/api/java/util/Arrays.html]

Static detection of calls to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.

Related Guidelines

Bibliography

[API 2006]	Class Arrays
[Seacord 2015]	Image Added EXP02-J. Do not use the Object.equals () method to compare two arrays LiveLesson

...

Image Added Image Added Image AddedEXP01-J. Do not confuse abstract object equality with reference equality      04. Expressions (EXP)      EXP03-J. Avoid the equal and not equal operators when comparing values of boxed primitives