...
Left- and right-shift operators are often employed to multiply or divide a number by a power of 2. This compromises code readability and portability for the sake of often-illusory speed gains. The JVM will usually make such optimizations automatically, and, unlike a programmer, the JVM can optimize for the implementation details of the current platform. This noncompliant code example includes both bit and arithmetic manipulations of the integer x
that conceptually contains a numeric value. The result is a prematurely optimized statement that assigns 5x + 1
to x
, which is what the programmer intended to express.
Code Block | ||
---|---|---|
| ||
int x = 50; x += (x << 2) + 1; |
...
In this noncompliant code example, the programmer wishes to devide x
by 4. Hence, the programmer attempts to optimize code by replacing a division with performance by using a right shift operation, rather than a division operation.
Code Block | ||
---|---|---|
| ||
int x = -50; x >>>= 2; |
...
Performing bit manipulation and arithmetic operations on the same variable obscures the programmer's intentions and reduces readability. This, in turn, makes it more difficult for a security auditor or maintainer to determine which checks must be performed to eliminate security flaws and ensure data integrity. For instance, overflow checks are critical for numeric types that undergo arithmetic operations, but less critical for numeric types that undergo bitwise operations.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
NUM01-J | medium | unlikely | medium | P4 | L3 |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f7000119618d6c62-87e940d7-4f434558-9313b375-92f0c186b7f2681c40ee4a50"><ac:plain-text-body><![CDATA[ | [[Steele 1977 | AA. Bibliography#Steele 1977]] | ]]></ac:plain-text-body></ac:structured-macro> |
...