1334
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 438 Behavioral Problems 2326
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Phase: Testing
Thoroughly test the comparison scheme before deploying code into production. Perform positive
testing as well as negative testing.
Demonstrative Examples
Example 1:
In the example below, two Java String objects are declared and initialized with the same string
values. An if statement is used to determine if the strings are equivalent.
Example Language: Java (Bad)
String str1 = new String("Hello");
String str2 = new String("Hello");
if (str1 == str2) {
CWE Version 4.14
CWE-1037: Processor Optimization Removal or Modification of Security-critical Code
CWE-1037: Processor Optimization Removal
or Modification of Security-critical Code 1870
System.out.println("str1 == str2");
}
However, the if statement will not be executed as the strings are compared using the "==" operator.
For Java objects, such as String objects, the "==" operator compares object references, not object
values. While the two String objects above contain the same string values, they refer to different
object references, so the System.out.println statement will not be executed. To compare object
values, the previous code could be modified to use the equals method:
Example Language: (Good)
if (str1.equals(str2)) {
System.out.println("str1 equals str2");
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
CWE-1037: Processor Optimization Removal or Modification of Securitycritical
Code
Weakness ID : 1037
Structure : Simple
Abstraction : Base
Description
The developer builds a security-critical protection mechanism into the software, but the processor
optimizes the execution of the program such that the mechanism is removed or modified.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1038 Insecure Automated Optimizations 1872
PeerOf 1264 Hardware Logic with Insecure De-Synchronization between
Control and Data Channels