The conditional AND and OR operators (&& and ||, respectively) exhibit "short-circuit" operation. That is, the second operand is not evaluated if the result can be deduced solely by evaluating the first operand.

One should exercise caution if the operands following the first operand contain side effects.

In the following code, the value of i is incremented only when i >= 0.

int i = /* initialize to user supplied value */
int max = /* initialize to maximum value */
if ( (i >= 0) && ( (i++) <= max) ) {
  /* code */
}

Although the behavior is well defined, it is not immediately obvious whether i gets incremented or not.

Noncompliant Code Example

In this noncompliant example, the programmer has combined two expressions in the if statement. The first checks whether the 'd' object is null and the second checks if the default security manager exists depending on which the security check will be performed. A conditional '&&' is used as using a conditional '||' would mean that whenever 'd' is null, the complete expression can still succeed depending on the value of sm. This would violate the invariants of d since it is desired that operations on it be prohibited if it is null. Unfortunately, when 'd' is equal to null as shown, the current if expression evaluates to false and the security check is not carried out as desired.

// d = null
SecurityManager sm = System.getSecurityManager();	  
if(d != null && sm != null) {
  FilePermission perm = new FilePermission("file.dat", "read");
  sm.checkPermission(perm);
  /* do something with d */
}
/* read the file (skips security check) */

Noncompliant Code Example

In this example, the programmer switches the ordering of the two subexpressions and uses a '||' operator to ensure the security check is carried out but does not realize that the second check would not be carried out if the first one succeeds. The result is the inadvertent modification of 'd'.

SecurityManager sm = System.getSecurityManager();	  
if(sm != null || d != null) {
  FilePermission perm = new FilePermission("file.dat", "read");
  sm.checkPermission(perm);
  // do something with d
}
// read the file

Compliant Solution

Decouple distinct operations that use the conditional AND and OR operators from expressions constituting decision statements. When inevitable, be aware of the short-circuit behavior and code accordingly.

if(d != null) { /* do something with d */ }

if(sm != null) {
  FilePermission perm = new FilePermission("file.dat", "read");
  sm.checkPermission(perm);
}
/* read the file (default security check is carried out) */

Exceptions

*EXP06-J-EX1:* Sometimes programmers who are aware of the short-circuit behavior use it to their advantage, as Flanagan \[[Flanagan 05|AA. Java References#Flanagan 05]\] exemplifies:

if (data != null && i < data.length && data[i] != -1) ... 

This snippet would sequentially execute the subexpressions and avoid an array indexing exception due to the checks that execute prior to the last (offending) subexpression.

Risk Assessment

Failing to understand the short-circuit behavior of the logical AND and OR operators may cause unintended program behavior.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] 15.23 "Conditional-And Operator &&" and 15.24 "Conditional-Or Operator ||"
\[[Flanagan 05|AA. Java References#Flanagan 05]\] 2.5.6. Boolean Operators

EXP05-J. Be careful about the wrapper class and autoboxing      02. Expressions (EXP)      02. Expressions (EXP)