VNX-768: Incorrect Short Circuit Evaluation
Reports Java and C# null guards joined to a dereference of the same variable by the non-short-circuit operators & and |, as in x != null & x.m(), which still dereferences x when it is null.
| Field | Value |
|---|---|
| Rule ID | VNX-768 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Java, C# |
| CWE | CWE-768 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | incorrect-short-circuit cwe-768 |
| Source | internal/sast/rules/vnx-768.rego |
Overview
VNX-768 maps to CWE-768: Incorrect Short Circuit Evaluation. It reports a Java or C# condition in which a null check is joined to the rest of the expression by & or | instead of && or ||, and the right operand dereferences the variable just checked:
x != null & x.isPaid(),null != x & x[0] ...x == null | x.isEmpty()
A guard at the end of a line whose right operand continues on the next line is also read.
Not reported: &&, ||, &= and |=; bitwise arithmetic on integers; null checks joined by & whose right operand does not dereference the guarded variable (no failure, only style); C# null-conditional access (x?.Items); comments and string literals.
Why This Matters
& and | evaluate both operands. The null check is evaluated, its result is ignored for control flow, and the dereference runs anyway: a null value throws NullPointerException / NullReferenceException. Where the check guards an authorisation or validation step, the exception path can skip it or crash the request.
What Gets Flagged
if (order != null & order.isPaid()) { ... } // flagged
return name == null | name.trim().isEmpty(); // flaggedreturn cart != null & cart.Items.Count > 0; // flaggedNot flagged:
if (order != null && order.isPaid()) { ... }
return (a != null) & (b != null);Remediation
Use the short-circuit operators && and || whenever the right operand depends on the left one.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-768
// nosec vnx-768Or record an ignore rule: vulnetix ignore add --rule vnx-768 --reason "...". See Suppressing findings.