VNX-697: Incorrect comparison: compareTo() against 1/-1, equals(null), or equality with NaN

Field	Value
Rule ID	VNX-697
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-697
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	incorrect-comparison cwe-697
Source	internal/sast/rules/vnx-697.rego

Overview

VNX-697 maps to CWE-697: Incorrect Comparison. A comparison that compiles but does not test what the author meant makes a limit, ordering or validity check take the wrong branch silently. The rule reports three Java shapes that are wrong by the language’s own contracts:

• compareTo()/compare() against 1 or -1. compareTo, compareToIgnoreCase and compare (Comparator, Integer.compare, Long.compare…) promise only the sign of their result. String.compareTo returns the character difference and many comparators return other magnitudes, so amount.compareTo(limit) == 1 is false for values that are over the limit. Both operand orders are reported.
• x.equals(null). A correct equals returns false for null, and when x is null the call throws, so the expression never detects a null.
• Equality with NaN. r == Double.NaN is always false and != always true.

Not reported: sign tests (> 0, < 0, == 0, >= 1), comparisons with other constants, Double.isNaN, x == null, Objects.equals(x, null), test files (where equals(null) checks the equals contract), comments and string literals. Timing-unsafe secret comparison is VNX-385 and VNX-CRYPTO-008; String == is VNX-597; boxed == is VNX-595.

What Gets Flagged

return amount.compareTo(limit) == 1;          // FLAGGED
return -1 == byPrice.compare(a, b);           // FLAGGED
if (c.getRegion().equals(null)) { ... }       // FLAGGED
if (r == Double.NaN) { ... }                  // FLAGGED

What Is Not Flagged

return amount.compareTo(limit) > 0;
if (Double.isNaN(r) || tag == null) { ... }

Remediation

1. Test the sign of compareTo/compare: > 0, < 0, == 0.
2. Use x == null (or Objects.isNull(x)) to detect null.
3. Use Double.isNaN(x)/Float.isNaN(x).

References

• CWE-697: Incorrect Comparison
• Comparable.compareTo contract

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-697
// nosec vnx-697

Or record an ignore rule: vulnetix ignore add --rule vnx-697 --reason "...". See Suppressing findings.