1937
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Language : JavaScript (Prevalence = Undetermined)
Language : PHP (Prevalence = Undetermined)
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
This weakness can lead to erroneous results that can
cause unexpected application behaviors.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
In Java, use the equals() method to compare objects instead of the == operator. If using ==, it
is important for performance reasons that your objects are created by a static factory, not by a
constructor.
Demonstrative Examples
Example 1:
In the example below, two Java String objects are declared and initialized with the same string
values. An if statement is used to determine if the strings are equivalent.
Example Language: Java (Bad)
String str1 = new String("Hello");
String str2 = new String("Hello");
if (str1 == str2) {
System.out.println("str1 == str2");
}
However, the if statement will not be executed as the strings are compared using the "==" operator.
For Java objects, such as String objects, the "==" operator compares object references, not object
values. While the two String objects above contain the same string values, they refer to different
object references, so the System.out.println statement will not be executed. To compare object
values, the previous code could be modified to use the equals method:
Example Language: (Good)
if (str1.equals(str2)) {
System.out.println("str1 equals str2");
CWE Version 4.14
CWE-595: Comparison of Object References Instead of Object Contents
CWE-595: Comparison of Object References Instead of Object Contents