EXP17-C. Do not perform bitwise operations in conditional expressions

Do not use the bitwise AND (&, ampersand) or bitwise OR (|, pipe) operator in a conditional expression because this typically indicates programmer error and can result in unexpected behavior. Only use & or | only for bitwise operations, and to use && or || only for logical operations.

Noncompliant Code Example

In this noncompliant code example, a bitwise expression is used in a conditional expression.

if (!(getuid() & geteuid() == 0)) { 
  /* ... */ 
} 

Compliant Solution

This compliant solution uses the && operator for the logical operation within the conditional expression.

if (!(getuid() && geteuid() == 0)) {
  /* ... */
}

Bibliography

[Hatton 95] Section 2.7.2, "Errors of omission and addition"
[ISO/IEC PDTR 24772] "KOA Likely Incorrect Expressions"
[[MITRE 07]] CWE ID 480, "Use of Incorrect Operator"