VNX-783: Operator Precedence Logic Error
Unparenthesised expressions whose precedence differs from their evident intent: assignment of a compared call, x & MASK == 0, x << 8 + y, !x === y, "a" + flag ? x : y, a + b ?? 0.
| Field | Value |
|---|---|
| Rule ID | VNX-783 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | C, C++, Java, JavaScript / TypeScript, PHP, Python, C# |
| CWE | CWE-783 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | operator-precedence cwe-783 |
| Source | internal/sast/rules/vnx-783.rego |
Overview
VNX-783 maps to CWE-783: Operator Precedence Logic Error. It reports expressions that the language groups differently from what the code plainly intends, only in the languages where the grouping is actually wrong:
| Shape | Parsed as | Languages |
|---|---|---|
if (fd = open(p, O_RDONLY) < 0) |
fd = (open(...) < 0) |
C, C++, JavaScript, PHP |
if n := len(d) > LIMIT: |
n := (len(d) > LIMIT) |
Python |
flags & MASK == 0 |
flags & (MASK == 0) |
C, C++, JavaScript, PHP |
hi << 8 + lo |
hi << (8 + lo) |
C, C++, Java, JavaScript, PHP, Python, C# |
!user.role === "admin" |
(!user.role) === "admin" |
C, C++, JavaScript, PHP |
!err instanceof AppError |
(!err) instanceof AppError |
JavaScript |
"Admin: " + isAdmin ? "yes" : "no" |
("Admin: " + isAdmin) ? ... |
JavaScript, PHP (.) |
"Owner: " + v == null ? "none" : v |
("Owner: " + v) == null ? ... |
Java, JavaScript, C# |
price + tax ?? 0 |
(price + tax) ?? 0 |
JavaScript/TypeScript, C# |
Not reported: the parenthesised forms; Go bitwise and shift expressions, and Python & against ==, where & and << bind tighter than == and +; Java & on booleans; C++ stream insertion (cout << 8 + n); a negation compared with a boolean, or (in C and PHP) with 0 or null, where both groupings give the same answer; $on = count($xs) > 0, a deliberate flag; comments and strings.
Why This Matters
A precedence slip turns a security check into a constant: if (!req.user.role === "admin") is always false, so the guard never denies, and fd = open(...) < 0 leaves fd holding 0 (stdin) or 1.
What Gets Flagged
if (st->st_mode & S_IWOTH != 0) /* FLAGGED */
uint16_t v = p[0] << 8 + p[1]; /* FLAGGED */if (!req.user.role === "admin") { // FLAGGEDNot flagged:
if ((fd = open(path, O_RDONLY)) < 0)
if ((flags & O_NONBLOCK) == 0)Remediation
Parenthesise the intended grouping, or use the dedicated operator (!==, !(x instanceof Y)).
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-783
// nosec vnx-783Or record an ignore rule: vulnetix ignore add --rule vnx-783 --reason "...". See Suppressing findings.