Wiki Markup &, |, ^, <<, and >>. Avoid mistakes regarding precedence through the suitable use of parentheses, which also improves code readability. The precedence of operations by the order of the subclauses is defined in the Java Tutorials [Tutorials 2013].
Although it Although the guideline EXP09-J. Do not depend on operator precedence while using expressions containing side-effects advises against depending on parentheses for specifying evaluation order , it EXP05-J. Do not follow a write by a subsequent write or read of the same object within an expression applies only to expressions that contain side - effects.
Noncompliant Code Example
The intent of the expression in this noncompliant code example is to add the variable OFFSET to the result of the bitwise logical AND between x and MASK.:
| Code Block | ||
|---|---|---|
| ||
public static final int MASK = 1337;
public static final int OFFSET = -1337;
public static int computeCode(int x) {
return x & MASK + OFFSET;
}
|
According to the operator precedence guidelines, the expression is parsed as the following:
| Code Block |
|---|
x & (MASK + OFFSET)
|
This expression gets is evaluated , as shown belowfollows, resulting in the value 0.:
| Code Block |
|---|
x & (1337 - 1337)
|
Compliant Solution
This compliant solution uses parentheses to ensure that the expression evaluates is evaluated as intended.:
| Code Block | ||
|---|---|---|
| ||
public static final int MASK = 1337;
public static final int OFFSET = -1337;
public static int computeCode(int x) {
return (x & MASK) + OFFSET;
}
|
Note that this solution performs bitwise operations on signed integers. Care must be exercised when doing this; see INT06-J. Avoid incorrect mixing of signed integers with bitwise operators for more information.
Exceptions
Noncompliant Code Example
In this noncompliant code example, the intent is to append either "0" or "1" to the string "value=":
| Code Block | ||
|---|---|---|
| ||
public class PrintValue {
public static void main(String[] args) {
String s = null;
// Prints "1"
System.out.println("value=" + s == null ? 0 : 1);
}
}
|
However, the precedence rules result in the expression to be printed being parsed as ("value=" + s) == null ? 0 : 1.
Compliant Solution
This compliant solution uses parentheses to ensure that the expression evaluates as intended:
| Code Block | ||
|---|---|---|
| ||
public class PrintValue {
public static void main(String[] args) {
String s = null;
// Prints "value=0" as expected
System.out.println("value=" + (s == null ? 0 : 1));
}
}
|
Applicability
Mistakes regarding precedence guidelines can cause an expression to be evaluated in an unintended way, which can lead to unexpected and abnormal program behavior.
EXP00-EX1: Parentheses may be omitted from mathematical expressions that follow conventional the algebraic orderprecedence rules. For instance, consider the following expression:
| Code Block |
|---|
x + y * z
|
By mathematical convention, multiplication is performed before addition; parentheses are redundant in this case.:
| Code Block | ||
|---|---|---|
| ||
x + (y * z)
|
Risk Assessment
Mistakes regarding precedence guidelines can cause an expression to be evaluated in an unintended way. This can lead to unexpected and abnormal program behavior.
...
Guideline
...
Severity
...
Likelihood
...
Remediation Cost
...
Priority
...
Level
...
EXP06-J
...
low
...
probable
...
medium
...
...
L3
...
Detection
...
Detection of all expressions using low-precedence operators without parentheses is straightforward. Determining the correctness of such uses is infeasible in the general case; , although heuristic warnings could be useful.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Related Guidelines
C Coding Standard: EXP00-C. Use parentheses for precedence of operation
C++ Secure Coding Standard: EXP00-CPP. Use parentheses for precedence of operation
Bibliography
| Wiki Markup |
|---|
\[[ESA 2005|AA. Bibliography#ESA 05]\] Rule 65: Use parentheses to explicitly indicate the order of execution of numerical operators
\[[Tutorials 2008|AA. Bibliography#Tutorials 08]\] [Expressions, Statements, and Blocks|http://java.sun.com/docs/books/tutorial/java/nutsandbolts/expressions.html], [Operators|http://java.sun.com/docs/books/tutorial/java/nutsandbolts/operators.html] |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.EXP53.APAREN | Use '()' to separate complex expressions | ||||||
| SonarQube |
| S864 |
Bibliography
[ESA 2005] | Rule 65, Use parentheses to explicitly indicate the order of execution of numerical operators |
...
INT10-J. Be aware of integer promotion behavior 04. Expressions (EXP) EXP07-J. Be aware of the short-circuit behavior of the conditional AND and OR operators