Bytes Equal On Netip

ID

go.bytes_equal_on_netip

Severity

low

Remediation Complexity

simple

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Go

Tags

CWE:697, correctness, reliability

Description

Reports bytes.Equal(a, b) where both arguments are net.IP values.

Rationale

A net.IP is a []byte under the hood, but two addresses can be equal while having different byte representations — an IPv4 address may be stored as a 4-byte slice or as a 16-byte IPv4-in-IPv6 slice. bytes.Equal compares the raw bytes and so reports such addresses unequal, whereas net.IP.Equal normalises the representations. The rule fires only when both arguments resolve to net.IP; a plain []byte operand or a mixed pair is left alone.

import (
    "bytes"
    "net"
)

func fn(a, b net.IP) {
    bytes.Equal(a, b) // FLAW — use a.Equal(b)
}

Remediation

Compare the addresses with a.Equal(b) instead of bytes.Equal(a, b).

References