Autoboxing can automatically wrap the primitive type to the corresponding wrapper object, which can be convenient in many cases and avoid clutter in code. But you should always be careful about this process, especially when doing comparisons. Section 5.1.7 of JLS 3rd Edition explains this point clearly:
"If the value p being boxed is true, false, a byte, a char in the range \u0000 to \u007f, or an int or short number between -128 and 127, then let r1 and r2 be the results of any two boxing conversions of p. It is always the case that r1 == r2."
Noncompliant Code Example
This code uses == to compare two integer objects. From EXP03-J we know that for == to return true for two object references, they must point to the same underlying object. So we can simply draw the conclusion that the results of using the == operator in this code will be false. However,
public class TestWrapper2 {
 public static void main(String[] args) {
  
  Integer i1 = 100;
     Integer i2 = 100;
     Integer i3 = 1000;
     Integer i4 = 1000;
     System.out.println(i1==i2);
     System.out.println(i1!=i2);
     System.out.println(i3==i4);
     System.out.println(i3!=i4);
    
 }
}
Output of This Code
Here the cache in the Integer class can only make the number from -127 to 128 refer to the same object, which clearly explains the result of the above code. To avoid making such mistakes, when you need to compare wrapper classes, use equal instead of == (see EXP03-J for details).
true false false true
Compliant Solution
Using object1.equals(object2) only compares their values. Now, the results will be true, as we expected.
public class TestWrapper2 {
 public static void main(String[] args) {
  
  Integer i1 = 100;
     Integer i2 = 100;
     Integer i3 = 1000;
     Integer i4 = 1000;
     System.out.println(i1.equals(i2));
     System.out.println(i3.equals(i4));    
 }
} 
Noncompliant Code Example
Sometimes you may want to create a dynamic array of integers. Unfortunately, the type parameter inside the angle brackets cannot be a primitive type. It is not possible to form an ArrayList<int>. Thanks to the wrapper class, now you can use ArrayList<Integer> to achieve this goal.
import java.util.ArrayList;
public class TestWrapper1 {
 public static void main(String[] args) {
  //create an array list of integers, which each element
  //is more than 127
     ArrayList<Integer> list1 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list1.add(i+1000);
  //create another array list of integers, which each element
  //is the same with the first one
     ArrayList<Integer> list2 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list2.add(i+1000);    
        
     int counter = 0;
     for(int i=0;i<10;i++)
      if(list1.get(i) == list2.get(i)) counter++;
     //output the total equal number
     System.out.println(counter);
 }
} 
In JDK 1.6.0_10, the output of this code is 0. In this code, we want to count the same numbers of array list1 and array list2. Undoubtedly, the result is not what we expect. Integer can only cache from -127 to 128, so when an int number is beyond this range, it will be autoboxed into different objects, and == will return false. But if we can set more caches inside Integer (cache all the integer values -32K-32K, which means that all the int values could be autoboxed to the same Integer object), then the result may be different.
Compliant Solution
public class TestWrapper1 {
 public static void main(String[] args) {
  //create an array list of integers, which each element
  //is more than 127
     ArrayList<Integer> list1 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list1.add(i+1000);
  //create another array list of integers, which each element
  //is the same with the first one
     ArrayList<Integer> list2 = new ArrayList<Integer>();
     for(int i=0;i<10;i++)
      list2.add(i+1000);    
        
     int counter = 0;
     for(int i=0;i<10;i++)
      if(list1.get(i).equals(list2.get(i))) counter++;
     //output the total equal number
     System.out.println(counter);
 }
}
In JDK 1.6.0_10, the output of this code is 10. (The reason is the same as the above code example.)
Risk Assessment
Using array lists with primitive types causes a potential security risk.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
EXP05-J |
medium |
likely |
low |
P9 |
L2 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
Chapter 5, Core Javaâ„¢ 2 Volume I - Fundamentals, Seventh Edition by Cay S. Horstmann, Gary Cornell
Publisher:Prentice Hall PTR;Pub Date:August 17, 2004.
Section 5.1.7, The Javaâ„¢ Language Specification,Third Edition by James Gosling, Bill Joy, Guy Steele, Gilad Bracha
Publisher:ADDISON-WESLEY;Pub Date:May 2005.
EXP04-J. Be wary of invisible implicit casts 02. Expressions (EXP) 03. Scope (SCP)