VNX-480: Use of Incorrect Operator

Reports operators that compile but do not do what the line means. Java: a String compared with == or != against a string literal (reference identity, not content) and a BigDecimal compared by reference with BigDecimal.ZERO/ONE/TEN. C: a char pointer compared with == or != against a string literal (address comparison; use strcmp). C/C++: a bit mask tested as flags & MASK == value, which parses as flags & (MASK == value). C/C++/Java: the transposed compound assignment x =+ n / x =- n (an assignment of +n, not an increment). Not reported: equals()/compareTo()/strcmp, comparisons with null, char literals, std::string compared with a literal in C++ (operator== compares content; a .h header that uses std::, class, namespace or template counts as C++), parenthesised masks ((flags & MASK) == value), x = -n written with a space, and operators inside strings and comments. Assignment used as a condition (if (x = y)) is VNX-481. A Java String compared with a string literal is reported by VNX-597 (String compared with == instead of equals()) and not here, unless the file never names the String type, which that rule needs.

Field	Value
Rule ID	`VNX-480`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++, Java
CWE	CWE-480
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`wrong-operator` `cwe-480`
Source	`internal/sast/rules/vnx-480.rego`

Overview

VNX-480 maps to CWE-480: Use of Incorrect Operator. Each shape below compiles, usually without a warning, and gives the wrong answer:

Java String identity: role == "admin" compares references. It is true for interned literals in tests and false for the same text read from a request, so a check that passes in development fails (or passes) in production.
Java BigDecimal identity: total == BigDecimal.ZERO is false for new BigDecimal("0.00").
C string literal: argv[1] == "--help" compares two addresses.
C/C++ mask precedence: flags & PERM_WRITE == 0 parses as flags & (PERM_WRITE == 0), which is always 0.
Transposed compound assignment (C/C++/Java): total =+ n assigns +n instead of adding it.

Not reported: equals(), compareTo(), strcmp(), comparisons with null, char literals, std::string == "..." in C++ (which compares content; a .h header that uses std::, class, namespace or template counts as C++), parenthesised masks (flags & MASK) == v, x = -n written with a space, and operators inside strings and comments. An assignment used as a condition (if (x = y)) is reported by VNX-481. A Java String compared with a string literal (role == "admin") is reported by VNX-597, so the same line is not reported twice; this rule keeps it only in a file that never names the String type, which VNX-597 needs.

What Gets Flagged

return total == BigDecimal.ZERO;        // FLAGGED
total =+ n;                             // FLAGGED

if (argc > 1 && argv[1] == "--help")    /* FLAGGED */
if (flags & PERM_WRITE == 0)            /* FLAGGED */

What Is Not Flagged

return role == "admin";                 // reported by VNX-597
return "admin".equals(role);
return total.compareTo(BigDecimal.ZERO) == 0;

if ((flags & PERM_WRITE) == 0)
if (strcmp(mode, "rw") == 0)

Remediation

Compare Java strings with equals() (constant first) and BigDecimal with compareTo() or signum().
Compare C strings with strcmp()/strncmp().
Parenthesise bitwise tests: (flags & MASK) == value.
Write compound assignments as += / -=.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-480
// nosec vnx-480

Or record an ignore rule: vulnetix ignore add --rule vnx-480 --reason "...". See Suppressing findings.