Do not use the assignment operator in the outermost expression of an if or switch statement or a looping statement (while, do, or for) conditional expressions because it typically indicates programmer error and can result in unexpected behavior. This means that the assignment operator should not be used in the following contexts:
- if (controlling expression)
- while (controlling expression)
- do ... while (controlling expression)
- for (second operand)
- switch (controlling expression)
- ?: (first operand)
- && (either operand)
- || (either operand)
- ?: (second or third operands) where the ternary expression is used in any of these contexts
Noncompliant Code Example
In this noncompliant code example, an assignment expression is the outermost controlling expression in an if statement.
...
Although the intent of the code could be to assign b to a and test the value of the result, it is frequently a case of the programmer mistakenly using the assignment operator = instead of the equals operator ==.
Compliant Solution
When the assignment of b to a is unintended, this conditional block is now executed when a is equal to b.
...
| Code Block | ||
|---|---|---|
| ||
public void f(boolean a, boolean b) {
a = b;
if (a) {
/* ... */
}
}
|
Risk Assessment
Errors of omission can result in unintended program flow.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP51-JG | low | likely | medium | P6 | L2 |
Related Guidelines
...
...
EXP18-C. Do not perform assignments in selection statements
Noncompliant Code Example
In this noncompliant code example, an assignment expression is the controlling expression is used with the && operator.
| Code Block | ||
|---|---|---|
| ||
public void f(boolean a, boolean b, boolean flag) {
while ( (a = b) && flag ) {
/* ... */
}
}
|
Again, this is frequently a case of the programmer mistakenly using the assignment operator = instead of the equals operator ==.
Compliant Solution
When the assignment of b to a is unintended, this conditional block is now executed when a is equal to b.
| Code Block | ||
|---|---|---|
| ||
public void f(boolean a, boolean b) {
while ( (a == b) && flag ) {
/* ... */
}
}
|
When the assignment is intended, one of the same solutions should be used as shown above.
Applicability
Errors of omission can result in unintended program flow.
...
CERT C++ Secure Coding Standard
...
"Likely Incorrect Expression [KOA]" | |
CWE ID 480, "Use of Incorrect Operator" |
Bibliography
Section 2.7.2, "Errors of omission and addition" |
EXP03-J. Do not use the equality operators when comparing values of boxed primitives
...