Page History

In Java, arrays are objects and support object methods such as Object.equals(). However, arrays do not support any methods besides those provided by Object. Consequently, using Object.equals() on any array compares only array references, not their contents. Programmers who wish to compare the contents of two arrays must use the static two-argument Arrays.equals() method. This method considers two arrays equivalent if both arrays contain the same number of elements, and all corresponding pairs of elements in the two arrays are equivalent, according to Object.equals(). In other words, two arrays are equal if they contain equivalent elements in the same order. To test for reference equality, use the reference equality operators, == and !=.  

Because the effect of using Object.equals() to compare two arrays is often misconstrued as content equality, and because a better alternative exists in the use of reference equality operators, the use of the Object.equals() method to compare two arrays is disallowedArrays do not override class Object's equals() method. Consequently, the default implementation of the equals() method simply compares the array references instead of the contents of the arrays. If only the references need to be compared, it is better to use relational operators, such as == and !=. Vulnerabilities can result, for instance, when two arrays containing signers are compared incorrectly.

Noncompliant Code Example

This noncompliant code example incorrectly uses the Object.equals() method to compare two arrays.:

int[] arr1 = new int[20]; // initializedInitialized to 0
int[] arr2 = new int[20]; // initializedInitialized to 0
System.out.println(arr1.equals(arr2)); // Prints false

Compliant Solution

This compliant solution compares the two content of two arrays using the two-argument Arrays.equals() method.:

int[] arr1 = new int[20]; // Initialized to 0
int[] arr2 = new int[20]; // Initialized to 0
System.out.println(Arrays.equals(arr1, arr2)); // Prints true

Compliant Solution

This compliant solution compares the array references using the reference equality operators ==:

int[] arr1 = new int[20]; // Initialized to 0
int[] arr2 = new int[20]; // Initialized to 0
System.out.println(arr1 == arr2); // Prints false 

Risk Assessment

Using the equals() method or relational operators to compare with the intention of comparing array contents can produce produces incorrect results, which can lead to vulnerabilities.

Automated Detection

...

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[API 06|AA. Java References#API 06]\] 

Static detection of calls to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.

Tool	Version	Checker	Description
CodeSonar	Include Page CodeSonar_V CodeSonar_V	JAVA.COMPARE.EQ JAVA.COMPARE.EQARRAY	Should Use equals() Instead of == (Java) equals on Array (Java)
Coverity	7.5	BAD_EQ FB.EQ_ABSTRACT_SELF FB.EQ_ALWAYS_FALSE FB.EQ_ALWAYS_TRUE FB.EQ_CHECK_FOR_OPERAND_NOT_ COMPATIBLE_WITH_THIS FB.EQ_COMPARETO_USE_OBJECT_ EQUALS FB.EQ_COMPARING_CLASS_NAMES FB.EQ_DOESNT_OVERRIDE_EQUALS FB.EQ_DONT_DEFINE_EQUALS_ FOR_ENUM FB.EQ_GETCLASS_AND_CLASS_ CONSTANT FB.EQ_OTHER_NO_OBJECT FB.EQ_OTHER_USE_OBJECT FB.EQ_OVERRIDING_EQUALS_ NOT_SYMMETRIC FB.EQ_SELF_NO_OBJECT FB.EQ_SELF_USE_OBJECT FB.EQ_UNUSUAL	Implemented
Parasoft Jtest	Include Page Parasoft_V Parasoft_V	CERT.EXP02.UEIC	Do not use '==' or '!=' to compare objects
SonarQube	Include Page SonarQube_V SonarQube_V	S2159	Silly equality checks should not be made

Related Guidelines

Bibliography

[API 2006]	Class Arrays
[Seacord 2015]	Image Added EXP02-J. Do not use the Object.equals () method to compare two arrays LiveLesson

...

Image Added Image Added Image AddedFIO36-J. Do not create multiple buffered wrappers on an InputStream      09. Input Output (FIO)      09. Input Output (FIO)