Page History

...

This compliant solution compares the content of two arrays using the two-argument Arrays.equals() method.:

int[] arr1 = new int[20]; // initializedInitialized to 0
int[] arr2 = new int[20]; // initializedInitialized to 0
System.out.println(Arrays.equals(arr1, arr2)); // printsPrints true

Compliant Solution

This compliant solution compares the array references using the reference equality operators ==:

...

Using the equals() method or relational operators with the intention of comparing array contents produces incorrect results, which can lead to vulnerabilities.

Automated Detection

Static detection of calls to to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.

Related Guidelines

Bibliography

[API 2006]	Class Arrays
[Seacord 2015]	Image Modified EXP02-J. Do not use the Object.equals () method to compare two arrays LiveLesson

...

...