1156
processed from user input. Assume the string has already been formatted such that different user
inputs are concatenated with the colon character. When the processString function is called, the
test for the colon character will result in an insertion of the colon character instead, adding new
input separators. Since the string was passed by reference, the data sentinels will be inserted
in the original string (CWE-464), and further processing of the inputs will be altered, possibly
malformed..
Example Language: C (Bad)
void processString (char *str) {
int i;
for(i=0; i<strlen(str); i++) {
if (isalnum(str[i])){
processChar(str[i]);
}
else if (str[i] = ':') {
movingToNewInput();}
}
}
}
Example 3:
The following Java example attempts to perform some processing based on the boolean value
of the input parameter. However, the expression to be evaluated in the if statement uses the
assignment operator "=" rather than the comparison operator "==". As with the previous examples,
the variable will be reassigned locally and the expression in the if statement will evaluate to true
and unintended processing may occur.
Example Language: Java (Bad)
public void checkValid(boolean isValid) {
if (isValid = true) {
System.out.println("Performing processing");
doSomethingImportant();
}
else {
System.out.println("Not Valid, do not perform processing");
return;
}
}
While most Java compilers will catch the use of an assignment operator when a comparison
operator is required, for boolean variables in Java the use of the assignment operator within an
expression is allowed. If possible, try to avoid using comparison operators on boolean variables in
java. Instead, let the values of the variables stand for themselves, as in the following code.
Example Language: Java (Good)
public void checkValid(boolean isValid) {
if (isValid) {
System.out.println("Performing processing");
doSomethingImportant();
}
else {
System.out.println("Not Valid, do not perform processing");
return;
}
}
Alternatively, to test for false, just use the boolean NOT operator.
CWE Version 4.14
CWE-482: Comparing instead of Assigning
CWE-482: Comparing instead of Assigning