CWE-597 在字符串比较中使用了错误的操作符

Use of Wrong Operator in String Comparison

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The product uses the wrong operator when comparing a string, such as using "==" when the equals() method should be used instead.

扩展描述

In Java, using == or != to compare two strings for equality actually compares two objects for equality, not their values. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, it could be leveraged to affect program security.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 595 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 595 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 480 cwe_View_ID: 1000

• cwe_Nature: ChildOf cwe_CWE_ID: 480 cwe_View_ID: 699

常见的影响

可能的缓解方案

Implementation

策略:

Use equals() to compare strings.

示例代码

例

In the example below, two Java String objects are declared and initialized with the same string values and an if statement is used to determine if the strings are equivalent.

bad Java

However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method:

good

分类映射

引用

• REF-62 The Art of Software Security Assessment

文章来源于互联网:scap中文网