1336
}
Example 2:
In the following Java example, two BankAccount objects are compared in the isSameAccount
method using the == operator.
Example Language: Java (Bad)
public boolean isSameAccount(BankAccount accountA, BankAccount accountB) {
return accountA == accountB;
}
Using the == operator to compare objects may produce incorrect or deceptive results by comparing
object references rather than values. The equals() method should be used to ensure correct results
or objects should contain a member variable that uniquely identifies the object.
The following example shows the use of the equals() method to compare the BankAccount objects
and the next example uses a class get method to retrieve the bank account number that uniquely
identifies the BankAccount object to compare the objects.
Example Language: Java (Good)
public boolean isSameAccount(BankAccount accountA, BankAccount accountB) {
return accountA.equals(accountB);
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 847 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 4 - Expressions (EXP)
844 2363
MemberOf 884 CWE Cross-section 884 2567
MemberOf 977 SFP Secondary Cluster: Design 888 2407
MemberOf 1136 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 02. Expressions (EXP)
1133 2445
MemberOf 1306 CISQ Quality Measures - Reliability 1305 2483
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
EXP02-J Use the two-argument Arrays.equals()
method to compare the contents of
arrays
The CERT Oracle Secure
Coding Standard for Java
(2011)
EXP02-J Use the two-argument Arrays.equals()
method to compare the contents of
arrays
The CERT Oracle Secure
Coding Standard for Java
(2011)
EXP03-J Do not use the equality operators when
comparing values of boxed primitives
References
[REF-954]Mozilla MDN. "Equality comparisons and sameness". < https://developer.mozilla.org/en-
US/docs/Web/JavaScript/Equality_comparisons_and_sameness >.2017-11-17.
CWE Version 4.14
CWE-597: Use of Wrong Operator in String Comparison
CWE-597: Use of Wrong Operator in String Comparison