CWE-1024: Comparison of Incompatible Types

What is Comparison of Incompatible Types?

• Overview: This vulnerability occurs when a program compares two values of different and incompatible types, which can lead to incorrect or unexpected results. This often happens due to assumptions about type conversion or implicit type casting in both strictly typed and loosely typed languages.

• Exploitation Methods:

• Attackers can manipulate input types to cause unexpected comparison results, potentially bypassing logic checks or authentication.
• Common attack patterns include using type coercion to trick the application into treating data differently than intended, such as exploiting the conversion of strings to numbers.

• Security Impact:

• Direct consequences include logical errors, incorrect decision-making, and vulnerabilities in authentication or authorization processes.
• Potential cascading effects include data integrity issues, unauthorized data access, and system compromise.
• Business impact may involve data breaches, loss of customer trust, and compliance violations, leading to financial and reputational damage.

• Prevention Guidelines:

• Specific code-level fixes involve ensuring explicit type checks and conversions, and avoiding assumptions about implicit type handling.
• Security best practices include using strict comparison operators where available (e.g., === in JavaScript) and validating input types before processing.
• Recommended tools and frameworks include static analysis tools that detect type mismatch issues and using languages or frameworks that enforce type safety.

Corgea can automatically detect and fix Comparison of Incompatible Types in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: JavaScript, PHP, Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

JavaScript Example

// This function is supposed to validate if a user input matches a predefined ID
function validateUserInput(userInput) {
    const predefinedId = 12345; // Predefined ID as a number
    // Vulnerable comparison: `userInput` is a string, while `predefinedId` is a number
    if (userInput == predefinedId) {  // This uses loose equality which performs type coercion
        return true;
    }
    return false;
}

// Example usage:
let input = "12345"; // User input as a string
console.log(validateUserInput(input)); // Returns true, but should be false due to type mismatch

Explanation

In the vulnerable code example, the == operator is used to compare userInput (a string) with predefinedId (a number). This operator performs type coercion, meaning it converts the operands to a common type before comparison, which can lead to unexpected results. Here, userInput being a string is coerced to a number, making the comparison return true despite the type mismatch.

How to fix Comparison of Incompatible Types?

Fixed Code Example

// This function is supposed to validate if a user input matches a predefined ID
function validateUserInput(userInput) {
    const predefinedId = 12345; // Predefined ID as a number
    // Convert userInput to a number before comparison and use strict equality
    const userInputNumber = Number(userInput); // Explicitly convert to number
    if (userInputNumber === predefinedId) {  // Use strict equality to avoid type coercion
        return true;
    }
    return false;
}

// Example usage:
let input = "12345"; // User input as a string
console.log(validateUserInput(input)); // Correctly returns true

Explanation

In the fixed code example, userInput is explicitly converted to a number using Number(userInput), and strict equality === is used for comparison. This ensures both the value and type are checked, preventing any unintended behavior due to type coercion. Always prefer === over == unless you specifically require type coercion, and manage types explicitly in your comparisons to avoid security vulnerabilities.