The product uses the wrong operator when comparing a string, such as using "==" when the equals() method should be used instead. In Java, using == or != to compare two strings for equality actually compares two objects for equality, not their values. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, it could be leveraged to affect program security. 1000 699 Weakness ChildOf 595 1000 699 Weakness ChildOf 480 699 Category ChildOf 133 844 Category ChildOf 847 888 Category ChildOf 885 Implementation Other Other Implementation Use equals() to compare strings. High In the example below, two Java String objects are declared and initialized with the same string values and an if statement is used to determine if the strings are equivalent. Java String str1 = new String("Hello"); String str2 = new String("Hello"); if (str1 == str2) { System.out.println("str1 == str2"); } However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method: if (str1.equals(str2)) { System.out.println("str1 equals str2"); } Mark Dowd John McDonald Justin Schuh The Art of Software Security Assessment Chapter 6, "Typos", Page 289. 1st Edition Addison Wesley 2006 Do not use the equality operators when comparing values of boxed primitives EXP03-J Do not use the equality operators when comparing values of boxed primitives EXP03-J Eric Dalci Cigital 2008-07-01 updated Potential_Mitigations, Time_of_Introduction CWE Content Team MITRE 2008-09-08 updated Description, Relationships CWE Content Team MITRE 2008-10-14 updated Relationships CWE Content Team MITRE 2009-05-27 updated Demonstrative_Examples CWE Content Team MITRE 2011-03-29 updated Demonstrative_Examples, Description, Potential_Mitigations CWE Content Team MITRE 2011-06-01 updated Common_Consequences, Relationships, Taxonomy_Mappings CWE Content Team MITRE 2012-05-11 updated Demonstrative_Examples, References, Relationships, Taxonomy_Mappings Erroneous String Compare