CWE-597: Use of Wrong Operator in String Comparison
View customized information:
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.
该表显示了与该弱点相关的弱点和高级类别。这些关系定义为childof,parentof,ementof,并深入了解可能存在于较高和较低抽象水平的类似项目。此外,定义了诸如Peerof和Canalsobe之类的关系,以显示用户可能想要探索的类似弱点。
Relevant to the view "Research Concepts" (CWE-1000)
Relevant to the view "Software Development" (CWE-699)
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
引言的不同模式提供了有关如何以及何时引入这种弱点的信息。该阶段识别可能发生介绍的生命周期中的一个点,而音符提供了与给定阶段中引言有关的典型情况。
该表指定与弱点相关的不同个人后果。该范围确定了违反的应用程序安全区域,而影响描述了如果对手成功利用这一弱点,就会产生负面的技术影响。其可能性提供了有关预期相对于列表中其他后果的特定后果的可能性的信息。例如,可能会利用弱点来实现一定的影响,但很可能会利用它来实现不同的影响。
Example 1 In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.
(bad code)
Example Language:爪哇
String str1 = new String("Hello");
字符串str2 = new String(“ Hello”); if (str1 == str2) {
System.out.println("str1 == str2"); }但是,由于使用“ ==”操作员比较字符串,因此不会执行IF语句。对于Java对象,例如字符串对象,“ ==”操作员比较对象引用,而不是对象值。尽管上面的两个字符串对象包含相同的字符串值,但它们是指不同的对象引用,因此System.out.println语句将不会执行。要比较对象值,可以修改以前的代码以使用等值方法:
(good code)
if (str1.equals(str2)) {
System.out.println("str1 equals str2"); }Example 2 In the example below, three JavaScript variables are declared and initialized with the same values. Note that JavaScript will change a value between numeric and string as needed, which is the reason an integer is included with the strings. An if statement is used to determine whether the values are the same.
(bad code)
Example Language:爪哇Script
(i === s1) is FALSE (s4 === i)是false (s4 === s1) is FALSE var i = 65; var s1 ='65'; var s4 = new String('65'); if (i === s1) {
document.getElementById(“ ieq3s1”)。innerhtml =“(i === s1)为true”; }如果(s4 === i) {
document.getElementById(“ s4eq3i”)。innerhtml =“(s4 === i)为true”; }if (s4 === s1) {
document.getElementById(“ s4eq3s1”)。innerhtml =“(s4 === s1)为true”; }但是,由于“ ===”比较了变量和值的类型,因此不会执行IF语句的主体。由于第一个比较的类型是数字和字符串,因此失败。第二个类型是int和参考,因此该类型也失败了。第三个类型是参考和字符串,因此也会失败。 尽管上面的变量包含相同的值,但它们包含在不同类型中,因此文档。getElementById...在任何情况下都不会执行语句。 为了比较对象值,修改了上一个代码并在下面显示以用于值比较的“ ==”,因此本示例中的比较执行HTML语句:
(good code)
Example Language:爪哇Script
(i == s1)是false (s4 == i)是false (s4 == s1) is FALSE var i = 65; var s1 ='65'; var s4 = new String('65'); if (i == s1) {
document.getElementById("ieq2s1").innerHTML = "(i == s1) is TRUE"; }如果(s4 == i) {
document.getElementById("s4eq2i").innerHTML = "(s4 == i) is TRUE"; }如果(S4 == S1) {
document.getElementById("s4eq2s1").innerHTML = "(s4 == s1) is TRUE"; }Example 3 In the example below, two PHP variables are declared and initialized with the same numbers - one as a string, the other as an integer. Note that PHP will change the string value to a number for a comparison. An if statement is used to determine whether the values are the same.
(bad code)
Example Language:PHP
var $i = 65;
var $ s1 =“ 65”; if ($i === $s1) {
echo'($ i === $ s1)是正确的'。“ \ n”; }else {
echo'($ i === $ s1)是false'。“ \ n”; }但是,由于“ ===”比较了变量和值的类型,因此不会执行IF语句的主体。由于第一个比较的类型是数字和字符串,因此失败。 While the variables above contain the same values, they are contained in different types, so the TRUE portion of the if statement will not be executed. To compare object values, the previous code is modified and shown below to use the "==" for value comparison (string converted to number) so the comparison in this example executes the TRUE statement:
(good code)
Example Language:PHP
var $i = 65;
var $ s1 =“ 65”; if ($i == $s1) {
echo'($ i == $ s1)是正确的'。“ \ n”; }else {
echo '($i == $s1) is FALSE'. "\n"; }
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
More information is available — Please select a different filter.
|
Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the使用条款. CWE is sponsored by theU.S. Department of Homeland Security(DHS)Cybersecurity and Infrastructure Security Agency(CISA),由Homeland Security Systems Engineering and Development Institute(HSSEDI) which is operated bymanbetx客户端首页(MITRE). Copyright © 2006–2023, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. |