VNX-482: Comparing instead of Assigning

Detects a statement that only compares, x == y; (or a Python test line cart.total == 0 with no assert), and a for loop whose initialiser compares (for (i == 0; ...)), in C, C++, JavaScript, TypeScript and Python. The result is discarded, so the intended assignment or assert never happens.

Field	Value
Rule ID	`VNX-482`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++, JavaScript / TypeScript, Python
CWE	CWE-482
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`comparison-statement` `cwe-482`
Source	`internal/sast/rules/vnx-482.rego`

Overview

VNX-482 maps to CWE-482: Comparing instead of Assigning. session.isAdmin === false; was meant to revoke a privilege and does nothing; cart.total == 0 in a Python test was meant to be an assert and checks nothing. The rule reports a line that is only lvalue == expression (or === in JavaScript/TypeScript) used as a statement, and for (i == 0; ...).

Not reported: comparisons that are part of a larger statement (assert, return, if, an assignment, a call argument, a ternary, a == b && f()), continuation lines of a multi-line expression (the previous line ends with an operator, a comma or an open bracket, or the next line continues it), Python docstrings, a comparison directly under with pytest.raises(...) or self.assertRaises(...) (evaluated on purpose to prove __eq__ raises), comparisons inside strings and comments, and Java and C#, where a statement that only compares does not compile.

What Gets Flagged

s->authenticated == 0;           /* FLAGGED: meant = */
for (i == 0; i < n; i++)         /* FLAGGED */

session.isAdmin === false;       // FLAGGED

def test_clear():
    cart.clear()
    cart.total == 0              # FLAGGED: missing assert

What Is Not Flagged

assert cart.total == 0
ok = a == b

Remediation

Use = when an assignment was meant.
In tests, write assert (or the framework’s assertion) in front of the comparison.
Enable the compiler or linter warning for unused expression results (-Wunused-value, ESLint no-unused-expressions, Ruff/Pylint B015/W0104).

References

CWE-482: Comparing instead of Assigning

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-482
// nosec vnx-482

Or record an ignore rule: vulnetix ignore add --rule vnx-482 --reason "...". See Suppressing findings.