CWE-597 在字符串比较中使用了错误的操作符

Use of Wrong Operator in String Comparison

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The product uses the wrong operator when comparing a string, such as using "==" when the equals() method should be used instead.

扩展描述

In Java, using == or != to compare two strings for equality actually compares two objects for equality, not their values. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, it could be leveraged to affect program security.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 595 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 595 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 480 cwe_View_ID: 1000

  • cwe_Nature: ChildOf cwe_CWE_ID: 480 cwe_View_ID: 699

常见的影响

范围 影响 注释
Other Other

可能的缓解方案

Implementation

策略:

Use equals() to compare strings.

示例代码

例

In the example below, two Java String objects are declared and initialized with the same string values and an if statement is used to determine if the strings are equivalent.

bad Java

String str1 = new String("Hello");
String str2 = new String("Hello");
if (str1 == str2) {
System.out.println("str1 == str2");
}

However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method:

good

if (str1.equals(str2)) {
System.out.println("str1 equals str2");
}

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
The CERT Oracle Secure Coding Standard for Java (2011) EXP03-J Do not use the equality operators when comparing values of boxed primitives
The CERT Oracle Secure Coding Standard for Java (2011) EXP03-J Do not use the equality operators when comparing values of boxed primitives
SEI CERT Perl Coding Standard EXP35-PL CWE More Specific Use the correct operator type for comparing values
Software Fault Patterns SFP1 Glitch in computation

引用