Comparison of Object References Instead of Object Contents

Opis

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

For example, in Java, comparing objects using == usually produces deceptive results, since the == operator compares object references rather than values; often, this means that using == for strings is actually comparing the strings' references, not their values.

Skutki

• Other

  Varies by Context

  This weakness can lead to erroneous results that can cause unexpected application behaviors.

Zapobieganie

• Implementation

  In Java, use the equals() method to compare objects instead of the == operator. If using ==, it is important for performance reasons that your objects are created by a static factory, not by a constructor.

Słabość nadrzędna

• CWE-1025 Comparison Using Wrong Factors

Słabości podrzędne

• CWE-597 Use of Wrong Operator in String Comparison
• CWE-1097 Persistent Storable Data Element without Associated Comparison Control Element

Kiedy powstaje

• Implementation

Dotyczy

Java, JavaScript, PHP, Not Language-Specific

Źródła

1. Equality comparisons and sameness — Mozilla MDN