REDUN.EQNULL

A redundant operation is one that does not have any effect, such as

• an assignment of a variable to itself
• use of an expression that will be evaluated to a constant such as a/a
• use of an expression that can be reduced to one operand such as a & a

Even if this is not an error on its own, it may indicate a larger error in the code. A REDUN.EQNULL warning is reported for a suspicious call to equals() with null passed as a parameter. Normally, equals(null) returns false (object is never equal to null).

Example 1

9
10
11
12
13
14
15
      public int test() {
         String s = "String";
         if (s.equals(null)) {
             return 1;
         }
         return 0;
     }

REDUN.EQNULL is reported for line 11: Suspicious equals() called with 's' and null (never true).

External guidance

• CERT EXP01-J: Do not use a null in a case where an object is required
• CWE-476: NULL Pointer Dereference
• CWE-570: Expression is Always False

Security training

Application security training materials provided by Secure Code Warrior.

• Null Dereference Training Video - Test your skills with a training example