1155
Scope Impact Likelihood
Other Alter Execution Logic
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Testing
Many IDEs and static analysis products will detect this problem.
Phase: Implementation
Place constants on the left. If one attempts to assign a constant with a variable, the compiler will
produce an error.
Demonstrative Examples
Example 1:
The following C/C++ and C# examples attempt to validate an int input parameter against the
integer value 100.
Example Language: C (Bad)
int isValid(int value) {
if (value=100) {
printf("Value is valid\n");
return(1);
}
printf("Value is not valid\n");
return(0);
}
Example Language: C# (Bad)
bool isValid(int value) {
if (value=100) {
Console.WriteLine("Value is valid.");
return true;
}
Console.WriteLine("Value is not valid.");
return false;
}
However, the expression to be evaluated in the if statement uses the assignment operator "="
rather than the comparison operator "==". The result of using the assignment operator instead of
the comparison operator causes the int variable to be reassigned locally and the expression in
the if statement will always evaluate to the value on the right hand side of the expression. This will
result in the input value not being properly validated, which can cause unexpected results.
Example 2:
In this example, we show how assigning instead of comparing can impact code when values are
being passed by reference instead of by value. Consider a scenario in which a string is being
CWE Version 4.14
CWE-481: Assigning instead of Comparing
CWE-481: Assigning instead of Comparing