Do not use the assignment operator in the outermost expression of an if
or switch
statement or a looping statement (while
, do
, or for
) because this typically indicates programmer error and can result in unexpected behavior.
Noncompliant Code Example
In this noncompliant code example, an assignment expression is the outermost expression in an if
statement.
public void exampleFunction(Object a, Object b){ if (a = b) { /* ... */ } }
While the intent of the code could be to assign b
to a
and test the value of the result for equality to zero, it is frequently a case of the programmer mistakenly using the assignment operator =
instead of the equals operator ==
.
Compliant Solution
When the assignment of b
to a
is unintended, this conditional block is now executed when a
is equal to b
.
public void exampleFunction(Object a, Object b){ if (a == b) { /* ... */ } }
When the assignment is intended, the following compliant solution may be used because the programmer's intent is clearer:
public void exampleFunction(Object a, Object b){ if ((a = b) == true) { /* ... */ } }
Although it could be preferable to express this same logic as an assignment followed by a conditional:
public void exampleFunction(Object a, Object b){ a = b; if (a == 0) { /* ... */ } }
Risk Assessment
Errors of omission can result in unintended program flow.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
EXP04-J |
low |
likely |
medium |
P6 |
L2 |
Related Guidelines
EXP19-CPP. Do not perform assignments in conditional expressions |
||||
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a576e82b-f921-4fa6-bfc0-88b564e3d151"><ac:plain-text-body><![CDATA[ |
[ISO/IEC TR 24772:2010 |
http://www.aitcnet.org/isai/] |
"Likely Incorrect Expression [java:KOA]" |
]]></ac:plain-text-body></ac:structured-macro> |
CWE ID 480, "Use of Incorrect Operator" |
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fd4f43db-14c2-43d3-84a0-b088eecf6c42"><ac:plain-text-body><![CDATA[ |
[java:[Hatton 1995 |
AA. References#Hatton 95]] |
Section 2.7.2, "Errors of omission and addition" |
]]></ac:plain-text-body></ac:structured-macro> |
02. Expressions (EXP) EXP05-J. Do not write more than once to the same variable within an expression