...
Using the equals() method or relational operators with the intention of comparing array contents produces incorrect results, which can lead to vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP02-J | Low | Likely | Low | P9 | L2 |
Automated Detection
Static detection of calls to to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| JAVA.COMPARE.EQ | Should Use equals() Instead of == (Java) | ||||||
| Coverity | 7.5 | BAD_EQ | Implemented | ||||||
| Parasoft Jtest |
| CERT.EXP02.UEIC | Do not use '==' or '!=' to compare objects | ||||||
| SonarQube |
| S2159 | Silly equality checks should not be made |
Related Guidelines
Bibliography
...