EFFECT

When another operation is used instead of = in assignment expression, the statement has no effect.

Vulnerability and risk

Potentially a critical problem.

Example 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
  class A{
     int foo(int);
  };
  int A::foo(int k){
       int j = 1;
       k = 0;
       if(j){
           j > k;  // EFFECT
           return j;
          }else{
           k++;
           return k;
          }
  }

External guidance

• CWE-480: Use of Incorrect Operator
• CWE-482: Comparing instead of Assigning
• CERT MSC12-C: Detect and remove code that has no effect or is never executed

Security training

Application security training materials provided by Secure Code Warrior.

• Business Logic Training Video - Test your skills with a training example