CWE-595: Comparison of Object References Instead of Object Contents
Variant
The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
For example, in Java, comparing objects using == usually produces deceptive results, since the == operator compares object references rather than values; often, this means that using == for strings is actually comparing the strings' references, not their values.
Consequences
- Other: Varies by Context
How to prevent it
- Implementation: In Java, use the equals() method to compare objects instead of the == operator. If using ==, it is important for performance reasons that your objects are created by a static factory, not by a constructor.
Recent advisories
- GHSA-m5pr-wm6q-x4g2 — usememos/memos vulnerable to Comparison of Object References Instead of Object Contents
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor