...
Using the equals() method or relational operators with the intention of comparing array contents produces incorrect results, which can lead to vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP02-J | Low | Likely | Low | P9 | L2 |
Automated Detection
Static detection of calls to to Object.equals() is straightforward. However, it is not always possible to statically resolve the class of a method invocation's target. Consequently, it may not always be possible to determine when Object.equals() is invoked for an array type.
Tool | Version | Checker | Description | ||||
|---|---|---|---|---|---|---|---|
| CodeSonar |
|
JAVA.COMPARE. |
EQ |
JAVA. |
COMPARE.EQARRAY | Should Use equals() Instead of == (Java) | ||
| Coverity | 7.5 | BAD_EQ | Implemented |
| Parasoft Jtest |
| CERT.EXP02.UEIC | Do not use '==' or '!=' to compare objects | ||||||
| SonarQube |
|
|
| S2159 |
| Silly equality checks should not be made |
Related Guidelines
Bibliography
...