{"@ID": "481", "@Name": "Assigning instead of Comparing", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Draft", "Description": "The code uses an operator for assignment when the intention was to perform a comparison.", "Dimensions": {"Dimension": [{"@Type": "Behavior-Type", "#text": "Assigning"}, {"@Type": "Behavior-Property", "#text": "instead of Comparing"}]}, "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "480", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "697", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": [{"@Name": "C", "@Prevalence": "Undetermined"}, {"@Name": "C++", "@Prevalence": "Undetermined"}, {"@Name": "Java", "@Prevalence": "Undetermined"}, {"@Name": "C#", "@Prevalence": "Undetermined"}]}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "In many languages, the compare statement is very\n\t close in appearance to the assignment statement and are\n\t often confused. This bug is generally the result of a\n\t typo. This usually causes obvious problems with program\n\t execution. If the comparison is in an \"if\" statement,\n\t the if statement will usually evaluate the value of the\n\t right-hand side of the predicate. As a result, this\n\t weakness might only go undetected if there's\n\t insufficient testing and rarely-reached code\n\t paths."}}, "Likelihood_Of_Exploit": "Low", "Common_Consequences": {"Consequence": {"Scope": "Other", "Impact": "Alter Execution Logic"}}, "Detection_Methods": {"Detection_Method": [{"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}, {"@Detection_Method_ID": "DM-16", "Method": "Automated Static Analysis - Source Code", "Description": "An Integrated Development Environment (IDE) or linter can report or highlight this weakness."}]}, "Potential_Mitigations": {"Mitigation": {"Phase": "Implementation", "Description": "Place constants on the left. If one attempts to assign a constant with a variable, the compiler will produce an error."}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-140", "Intro_Text": "The following C/C++ and C# examples attempt to validate an int input parameter against the integer value 100.", "Example_Code": [{"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "printf(\"Value is valid\\n\");return(1);"}, "xhtml:br": [null, null], "#text": "if (value=100) {}printf(\"Value is not valid\\n\");return(0);"}, "#text": "int isValid(int value) {}"}, "#text_blocks": ["int isValid(int value) {", "if (value=100) {", "printf(\"Value is valid\\n\");", "return(1);", "}", "printf(\"Value is not valid\\n\");", "return(0);", "}"]}, {"@Nature": "Bad", "@Language": "C#", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "Console.WriteLine(\"Value is valid.\");return true;"}, "xhtml:br": [null, null], "#text": "if (value=100) {}Console.WriteLine(\"Value is not valid.\");return false;"}, "#text": "bool isValid(int value) {}"}, "#text_blocks": ["bool isValid(int value) {", "if (value=100) {", "Console.WriteLine(\"Value is valid.\");", "return true;", "}", "Console.WriteLine(\"Value is not valid.\");", "return false;", "}"]}], "Body_Text": "However, the expression to be evaluated in the if statement uses the assignment operator \"=\" rather than the comparison operator \"==\". The result of using the assignment operator instead of the comparison operator causes the int variable to be reassigned locally and the expression in the if statement will always evaluate to the value on the right hand side of the expression. This will result in the input value not being properly validated, which can cause unexpected results."}, {"Intro_Text": "In this example, we show how assigning instead of comparing can impact code when values are being passed by reference instead of by value. Consider a scenario in which a string is being processed from user input. Assume the string has already been formatted such that different user inputs are concatenated with the colon character. When the processString function is called, the test for the colon character will result in an insertion of the colon character instead, adding new input separators. Since the string was passed by reference, the data sentinels will be inserted in the original string (CWE-464), and further processing of the inputs will be altered, possibly malformed.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": [{"@style": "margin-left:1em;", "#text": "processChar(str[i]);"}, {"@style": "margin-left:1em;", "#text": "movingToNewInput();}"}], "xhtml:br": null, "#text": "if (isalnum(str[i])){}else if (str[i] = ':') {}"}, "#text": "int i;\n for(i=0; i