CWE-597: Use of Wrong Operator in String Comparison
View customized information:
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.
![]() ![]()
![]() ![]()
![]() ![]()
![]()
![]()
Example 1 In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.
(bad code)
Example Language:爪哇
String str1 = new String("Hello");
字符串str2 = new String(“ Hello”); if (str1 == str2) {
System.out.println("str1 == str2"); }但是,由于使用“ ==”操作员比较字符串,因此不会执行IF语句。对于Java对象,例如字符串对象,“ ==”操作员比较对象引用,而不是对象值。尽管上面的两个字符串对象包含相同的字符串值,但它们是指不同的对象引用,因此System.out.println语句将不会执行。要比较对象值,可以修改以前的代码以使用等值方法:
(good code)
if (str1.equals(str2)) {
System.out.println("str1 equals str2"); }Example 2 In the example below, three JavaScript variables are declared and initialized with the same values. Note that JavaScript will change a value between numeric and string as needed, which is the reason an integer is included with the strings. An if statement is used to determine whether the values are the same.
(bad code)
Example Language:爪哇Script
(i === s1) is FALSE (s4 === i)是false (s4 === s1) is FALSE var i = 65; var s1 ='65'; var s4 = new String('65'); if (i === s1) {
document.getElementById(“ ieq3s1”)。innerhtml =“(i === s1)为true”; }如果(s4 === i) {
document.getElementById(“ s4eq3i”)。innerhtml =“(s4 === i)为true”; }if (s4 === s1) {
document.getElementById(“ s4eq3s1”)。innerhtml =“(s4 === s1)为true”; }但是,由于“ ===”比较了变量和值的类型,因此不会执行IF语句的主体。由于第一个比较的类型是数字和字符串,因此失败。第二个类型是int和参考,因此该类型也失败了。第三个类型是参考和字符串,因此也会失败。 尽管上面的变量包含相同的值,但它们包含在不同类型中,因此文档。getElementById...在任何情况下都不会执行语句。 为了比较对象值,修改了上一个代码并在下面显示以用于值比较的“ ==”,因此本示例中的比较执行HTML语句:
(good code)
Example Language:爪哇Script
(i == s1)是false (s4 == i)是false (s4 == s1) is FALSE var i = 65; var s1 ='65'; var s4 = new String('65'); if (i == s1) {
document.getElementById("ieq2s1").innerHTML = "(i == s1) is TRUE"; }如果(s4 == i) {
document.getElementById("s4eq2i").innerHTML = "(s4 == i) is TRUE"; }如果(S4 == S1) {
document.getElementById("s4eq2s1").innerHTML = "(s4 == s1) is TRUE"; }Example 3 In the example below, two PHP variables are declared and initialized with the same numbers - one as a string, the other as an integer. Note that PHP will change the string value to a number for a comparison. An if statement is used to determine whether the values are the same.
(bad code)
Example Language:PHP
var $i = 65;
var $ s1 =“ 65”; if ($i === $s1) {
echo'($ i === $ s1)是正确的'。“ \ n”; }else {
echo'($ i === $ s1)是false'。“ \ n”; }但是,由于“ ===”比较了变量和值的类型,因此不会执行IF语句的主体。由于第一个比较的类型是数字和字符串,因此失败。 While the variables above contain the same values, they are contained in different types, so the TRUE portion of the if statement will not be executed. To compare object values, the previous code is modified and shown below to use the "==" for value comparison (string converted to number) so the comparison in this example executes the TRUE statement:
(good code)
Example Language:PHP
var $i = 65;
var $ s1 =“ 65”; if ($i == $s1) {
echo'($ i == $ s1)是正确的'。“ \ n”; }else {
echo '($i == $s1) is FALSE'. "\n"; }
![]()
More information is available — Please select a different filter.
|
Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the使用条款. CWE is sponsored by theU.S. Department of Homeland Security(DHS)Cybersecurity and Infrastructure Security Agency(CISA),由Homeland Security Systems Engineering and Development Institute(HSSEDI) which is operated bymanbetx客户端首页(MITRE). Copyright © 2006–2023, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. |