Page History

...

This guideline demonstrates how conflicts can arise between the above two statements when expressions contain side-effects.

Noncompliant Code Example

This noncompliant example shows how side-effects in expressions can lead to unanticipated outcomes. The programmer intends to write some access control logic based on different threshold levels. Each user has a rating that must be above the threshold, in order to be granted appropriate access. As shown, a simple function is used to calculate the rating. The get() method has been used to provide a non-zero factor when the user is authorized and a zero value, when not.

...

class BadPrecedence {
  public static void main(String[] args) {
    int number=17;
    int[] threshold = new int[20];
    threshold[0] = 10;
    number = (number > threshold[0]? 0:-2) + ((31 * ++number) * (number=get()));
    // ... 
    if(number == 0)
      System.out.println("Access granted");
    else
      System.out.println("Denied access"); // number = -2
  }
  public static int get() {
    int number=0;
    // assign number to non zero value if authorized else 0
    return number;
  }
}

Compliant Solution

While diligently following the left to right evaluation order, a programmer can expect this compliant code to evaluate to an expected final outcome depending on the value returned by the get() method.

...

Although this solution solves the problem, in general, it is advisable to avoid using expressions with more than one side-effect. It is also inadvisable to depend on the left-right ordering for evaluation of side-effects since operands are evaluated in place first, and then subject to laws of operator precedence and associativity.

Risk Assessment

Side-effects in expressions can be misleading due to their evaluation order. Failing to keep the order in mind can result in unexpected output.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] Section 15.7 "Evaluation Order" and 15.7.3 "Evaluation Respects Parentheses and Precedence"

...