VNX-481: Assigning instead of Comparing

Detects an if or while condition that is a bare assignment, if (x = y), in C, C++ and Java, where a comparison (==) was meant. The deliberate double-parenthesis form is not reported.

Field	Value
Rule ID	`VNX-481`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++, Java
CWE	CWE-481
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`assignment-condition` `cwe-481`
Source	`internal/sast/rules/vnx-481.rego`

Overview

VNX-481 maps to CWE-481: Assigning instead of Comparing. if (uid = 0) overwrites uid and tests the assigned value, so the branch is never taken and the variable now holds the wrong value; if (isAdmin = true) makes every user an admin. The rule reports an if or while whose condition starts with lvalue = expression (including *p = ..., s->field = ..., a[i] = ...).

Not reported: the conventional deliberate form with an extra pair of parentheses (if ((p = next())), while ((c = getc(f)) != EOF)), comparisons (==, <=, >=, !=), the comma operator (while (p = q, q = next(q), p)), the C++17 init-statement (if (err = f(); err != 0)), assignments in for headers and ordinary statements, and conditions in strings and comments.

What Gets Flagged

if (uid = 0) {               /* FLAGGED */
while (n->state = 1) {       /* FLAGGED */

if (isAdmin = true) {        // FLAGGED

What Is Not Flagged

while ((c = getc(in)) != EOF)
if ((p = malloc(16)))
if (a == b)

Remediation

Use == for comparison.
When the assignment is intended, move it to its own statement or wrap it in a second pair of parentheses and compare explicitly: if ((p = next()) != NULL).
Compile C/C++ with -Wparentheses (part of -Wall).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-481
// nosec vnx-481

Or record an ignore rule: vulnetix ignore add --rule vnx-481 --reason "...". See Suppressing findings.