COMMON WEAKNESS ENUMERATIONDraft

CWE-481

Assigning instead of Comparing

The code uses an operator for assignment when the intention was to perform a comparison.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Low

Understand the problem

What is the problem?

The code uses an operator for assignment when the intention was to perform a comparison.

Extended description

In many languages the compare statement is very close in appearance to the assignment statement and are often confused. This bug is generally the result of a typo and usually causes obvious problems with program execution. If the comparison is in an if statement, the if statement will usually evaluate the value of the right-hand side of the predicate.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Alter Execution Logic

Affected security scopes: Other

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Place constants on the left. If one attempts to assign a constant with a variable, the compiler will produce an error.

Verification

How is it detected?

Automated Static Analysis

High
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Automated Static Analysis - Source Code

An Integrated Development Environment (IDE) or linter can report or highlight this weaknesses.
CWE-481: Common Weakness Enumeration Entry CWE-481 · DayBreach Sözlük · DayBreach