Page History

Do not use Using the assignment operator in the outermost expression of a selection statement (if or switch) or an iteration statement (while, do, or for) because this typically conditional expressions frequently indicates programmer error and can result in unexpected behavior. The assignment operator should not be used in the following contexts:

• if  (controlling expression)
• while (controlling expression)
• do ... while (controlling expression)
• for (second operand)
• switch (controlling expression)
• ?:  (first operand)
• &&  (either operand)
• ||  (either operand)
• ?:  (second or third operands) where the ternary expression is used in any of these contexts

Noncompliant Code Example

In this noncompliant code example, an assignment expression is the outermost controlling expression in an the if statement .is an assignment expression:

public void f(boolean a, boolean b) {
  if (a = b) {
    /* ... */
  }
}

While Although the intent of the code may be programmer's intent could have been to assign b to a and test the value of the result for equality to zero, it is very frequently a case of , this usage frequently occurs when the programmer mistakenly using used the assignment operator = instead of rather than the equals equality operator ==. Consequently, many compilers will warn about this condition making this coding error detectable by adhering to recommendation MSC00-C. Compile cleanly at high warning levels.

Compliant Solution

When the assignment of b to a is not intended, this conditional block is now executed The conditional block shown in this compliant solution executes only when a is equal to b.:

public void f(boolean a, boolean b) {
  if (a == b) {
    /* ... */
  }
}

Unintended assignment of b to a cannot occur.

Compliant Solution

When the assignment is , if fact, intended, this is an alternative compliant solution clarifies the programmer's intent:

public void f(boolean a, boolean b) {
  if ((a = b) !== 0true) {
    /* ... */
  }
}

Compliant Solution

It is less desirable in general, depending on what was intended because it mixes the assignment in the condition, but it is clear that the programmer intended the assignment to occur.

Risk Assessment

Errors of omission can result in unintended program flow.

may be clearer to express the logic as an explicit assignment followed by the if condition:

public void f(boolean a, boolean b) {
  a = b;
  if (a) {
    /* ... */
  }
}

Noncompliant Code Example

In this noncompliant code example, an assignment expression appears as an operand of the && operator:

public void f(boolean a, boolean b, boolean flag) {
  while ( (a = b) && flag ) {
    /* ... */
  }
}

Because && is not a comparison operator, assignment is an illegal operand. Again, this is frequently a case of the programmer mistakenly using the assignment operator = instead of the equals operator ==.

Compliant Solution

When the assignment of b to a is unintended, this conditional block is now executed only when a is equal to b and flag is true:

public void f(boolean a, boolean b, boolean flag) {
  while ( (a == b) && flag ) {
    /* ... */
  }
}

Applicability

The use of the assignment operator in controlling conditional expressions frequently indicates programmer error and can result in unexpected behavior.

As an exception to this guideline, it is permitted to use the assignment operator in conditional expressions when the assignment is not the controlling expression (that is, the assignment is a subexpression), as shown in the following compliant solution:

public void assignNocontrol(BufferedReader reader)
    throws IOException{
  String line;
  while ((line = reader.readLine()) != null) {
    // ... Work with line
  }
}

...

Recommendation

...

Severity

...

Likelihood

...

Remediation Cost

...

Priority

...

Level

...

EXP18-C

...

low

...

likely

...

medium

...

P6

...

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: EXP19-CPP. Do not perform assignments in conditional expressions

ISO/IEC TR 24772 "KOA Likely Incorrect Expressions"

MITRE CWE: CWE-480, "Use of Incorrect Operator"

Bibliography

\[[Hatton 1995|AA. Bibliography#Hatton 95]\] Section 2.7.2, "Errors of omission and addition"

Bibliography

...

Image Added Image Added Image AddedEXP17-C. Do not perform bitwise operations in conditional expressions      03. Expressions (EXP)      EXP19-C. Use braces for the body of an if, for, or while statement