CWE-482: Comparing instead of Assigning
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The code uses an operator for comparison when the intention was to perform an assignment.
扩展描述
In many languages, the compare statement is very close in appearance to the assignment statement; they are often confused.
常见后果
影响范围: Availability Integrity
技术影响: Unexpected State
说明: The assignment will not take place, which should cause obvious program execution problems.
潜在缓解措施
阶段: Testing
描述: Many IDEs and static analysis products will detect this problem.
检测方法
方法: Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性: High
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | This bug primarily originates from a typo. |
适用平台
编程语言
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| CLASP | - | Comparing instead of assigning | - |
| Software Fault Patterns | SFP2 | Unused Entities | - |