Use of Wrong Operator in String Comparison

Opis

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.

Skutki

• Other

  Other

Zapobieganie

• Implementation

  Within Java, use .equals() to compare string values. Within JavaScript, use == to compare string values. Within PHP, use == to compare a numeric value to a string value. (PHP converts the string to a number.)

  Skuteczność: High

Słabość nadrzędna

• CWE-595 Comparison of Object References Instead of Object Contents
• CWE-480 Use of Incorrect Operator

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Java, JavaScript, PHP

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 6, "Typos", Page 289, Addison Wesley, 2006