1157
Example Language: Java (Good)
public void checkValid(boolean isValid) {
if (!isValid) {
System.out.println("Not Valid, do not perform processing");
return;
}
System.out.println("Performing processing");
doSomethingImportant();
}
Example 4:
The following example demonstrates the weakness.
Example Language: C (Bad)
void called(int foo){
if (foo=1) printf("foo\n");
}
int main() {
called(2);
return 0;
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1157 SEI CERT C Coding Standard - Guidelines 03.
Expressions (EXP)
1154 2455
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Assigning instead of comparing
Software Fault Patterns SFP1 Glitch in computation
CERT C Secure Coding EXP45-C CWE More
Abstract
Do not perform assignments in
selection statements
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-482: Comparing instead of Assigning
Weakness ID : 482
Structure : Simple
Abstraction : Variant
Description
The code uses an operator for comparison when the intention was to perform an assignment.
CWE Version 4.14
CWE-482: Comparing instead of Assigning
CWE-482: Comparing instead of Assigning