Assigning instead of Comparing

Opis

The code uses an operator for assignment when the intention was to perform a comparison.

In many languages the compare statement is very close in appearance to the assignment statement and are often confused. This bug is generally the result of a typo and usually causes obvious problems with program execution. If the comparison is in an if statement, the if statement will usually evaluate the value of the right-hand side of the predicate.

Skutki

• Other

  Alter Execution Logic

Zapobieganie

• Implementation

  Place constants on the left. If one attempts to assign a constant with a variable, the compiler will produce an error.

Słabość nadrzędna

• CWE-480 Use of Incorrect Operator

Może prowadzić do

• CWE-697 Incorrect Comparison

Kiedy powstaje

• Implementation

Dotyczy

C, C++, Java, C#

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 6, "Typos", Page 289, Addison Wesley, 2006