Page History

Programmers frequently make errors regarding the precedence rules of operators due to because of the unintuitive unintuitively low - precedence levels of &, |, ^, <<, and >>. Mistakes Avoid mistakes regarding precedence rules can be avoided by through the suitable use of parentheses. Defensive use of parentheses, if not taken to excess, , which also improves code readability. The Java Tutorials defines the precedence of operation operations by the order of the subclauses .is defined in the Java Tutorials [Tutorials 2013].

Although it advises against depending on parentheses for specifying evaluation order EXP05-J. Do not follow a write by a subsequent write or read of the same object within an expression applies only to expressions that contain This recommendation is similar to EXP30-J, however it applies to more than expressions containing side effects.

Noncompliant Code Example

The intent of the expression in this noncompliant code example is to add the variable OFFSET with to the result of the bitwise logical AND between x and MASK.:

public static final int MASK = 1337;
public static final int OFFSET = -1337;

public static int computeCode(int x) {
  return x & MASK + OFFSET;
}

Due According to the operator precedence rulesguidelines, the expression is parsed as the following:

x & (MASK + OFFSET)

This gets expression is evaluated as shown belowfollows, resulting in the value 0.:

x & (1337 - 1337)

Compliant Solution

In this This compliant solution , uses parentheses are used to ensure that the expression evaluates as expected.is evaluated as intended:

public static final int MASK = 1337;
public static final int OFFSET = -1337;

public static int computeCode(int x) {
  return (x & MASK) + OFFSET;
}

Exceptions

Noncompliant Code Example

In this noncompliant code example, the intent is to append either "0" or "1" to the string "value=":

public class PrintValue {
  public static void main(String[] args) {
    String s = null;
    // Prints "1"
    System.out.println("value=" + s == null ? 0 : 1);
  }
}

However, the precedence rules result in the expression to be printed being parsed as ("value=" + s) == null ? 0 : 1.

Compliant Solution

This compliant solution uses parentheses to ensure that the expression evaluates as intended:

public class PrintValue {
  public static void main(String[] args) {
    String s = null;
    // Prints "value=0" as expected
    System.out.println("value=" + (s == null ? 0 : 1));
  }
}

Applicability

Mistakes regarding precedence guidelines can cause an expression to be evaluated in an unintended way, which can lead to unexpected and abnormal program behavior.

Parentheses may be omitted from mathematical expressions that follow the algebraic precedence rulesEXP00-EX1: Mathematical expressions that follow algebraic order do not require parentheses. For instance, consider the following expression:

x + y * z

By mathematical convention, multiplication is performed before addition. Consequently, parentheses may prove to be ; parentheses are redundant in this case.:

x + (y * z)

Risk Assessment

Mistakes regarding precedence rules may cause an expression to be evaluated in an unintended way. This can lead to unexpected and abnormal program behavior.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C Coding Standard as EXP00-C. Use parentheses for precedence of operation.

This rule appears in the C++ Secure Coding Standard as EXP00-CPP. Use parentheses for precedence of operation.

References

Detection of all expressions using low-precedence operators without parentheses is straightforward. Determining the correctness of such uses is infeasible in the general case, although heuristic warnings could be useful.

Automated Detection

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Expressions, Statements, and Blocks|http://java.sun.com/docs/books/tutorial/java/nutsandbolts/expressions.html]