String Comparison

ID

csharp.stringcomparison

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

CSharp

Tags

culture, reliability, string

Description

Reports string.Equals(other) invocations that omit a StringComparison argument. The single-argument overload uses the current culture’s collation, so the same call returns different results depending on the user’s locale.

Rationale

Equality on invariant data — file paths, identifiers, protocol tokens — should be explicit. The Turkish dotted/dotless i is the canonical example: a call that returns true in en-US returns false in tr-TR, and the bug only surfaces when the program runs in the second locale.

public class Comparer
{
    public bool MatchTurkish(string a, string b)
    {
        return a.Equals(b);                                  // FLAW
    }

    public bool MatchOrdinal(string a, string b)
    {
        return a.Equals(b, StringComparison.Ordinal);        // OK
    }
}

Remediation

Use the two-argument overload and pass an explicit StringComparison. For invariant data prefer StringComparison.Ordinal (or OrdinalIgnoreCase); for user-visible text collation use CurrentCulture deliberately.

References