CWE-783: Operator Precedence Logic Error
Failing to understand the order of precedence in expressions that read and write to the same object can lead to unintended side effects.
Python has distinct different concepts for:
|
type
|
examples |
Typical direction |
| Assignments | to store a value such as x = 1 | right-to-left. |
| Expressions | 3+4 or x*2 | left-to-right |
| Augmented assignments | a += 1 | left-to-right [Python docs 2025 - simple statements] |
</table>
Expressions such as `2 ** 3`, or two to the power of three, are evaluated from right to left [[python power 2025](https://docs.python.org/3/reference/expressions.html#index-59)] as demonstrated in `example01.py`
_[example01.py:](/Secure-Coding-Guide-for-Python/CWE-691/CWE-783/example01.py)_
```py
"""Code Example"""
print(2**3**2) # prints 512
print((2**3) ** 2) # prints 64
print(2**9)
```
The first expression would print `64` if Python would resolve from left-to-right but prints `512` as it calculates `3**2` before using its result with `2**9`.
The `example02.py` behaves 'normal' for a programmer but makes no sense as a mathematical formular.
_[example02.py:](/Secure-Coding-Guide-for-Python/CWE-691/CWE-783/example02.py)_
```py
z = 2
z *= 2 + 1
print(f"z *= 2 + 1 ={z}")
```
If a method changes an object’s state (has side effects) and is called multiple times within one expression, the result can be surprising and incorrect. For further info on python's order of precedence refer to The Python Language Specification , §6.16, "Evaluation Order" [[PLR 2022](https://docs.python.org/3/reference/expressions.html#evaluation-order)].
## Non-Compliant Code Example
`noncompliant01.py` is expected to provide labels for numbers, but it unnecessarily obfuscates the evaluation and logic.
_[noncompliant01.py](/Secure-Coding-Guide-for-Python/CWE-691/CWE-783/noncompliant01.py):_
```python
"""Non-Compliant Code Example"""
def label(number: int) -> list[str]:
key = int(number < 5) # (1) small
key |= ((number & 1) ^ 1) << 1 # (2) for even, 0 for odd
key |= (number < 0) << 2 # (4) negative
key |= (number > 0) << 3 # (8) positive
parts = (
"big", # 0
"small", # 1
"even small", # 2
"even small", # 3
"neg", # 4
"neg small", # 5
"neg even small", # 6
"neg even small", # 7
"big", # 8
"big even", # 9
"neg big", # 10
"neg big even", # 11
"big", # 12
"big even", # 13
"neg big", # 14
"neg big even", # 15
)
permuted = tuple(parts[(i * 5) & 7] for i in range(8))
idx = (key * 5) & 7
return permuted[idx].split(" ")
for number in range(-6, 6):
print(f"{number} = {label(number)}")
```
_Example output of `noncompliant01.py`:_
```bash
-6 = ['neg', 'even', 'small']
-5 = ['neg', 'small']
-4 = ['neg', 'even', 'small']
-3 = ['neg', 'small']
-2 = ['neg', 'even', 'small']
-1 = ['neg', 'small']
0 = ['even', 'small']
1 = ['small']
2 = ['even', 'small']
3 = ['small']
4 = ['even', 'small']
5 = ['big']
```
The `noncompliant01.py` does respond with the correct output. Extending the `noncompliant01.py` to also a label `postive` or `zero` numbers would be challenging.
## Compliant Solution
This compliant solution, uses equivalent logic and performs at most one write operation per expression, which makes the code easier to understand and maintain.
_[compliant01.py](/Secure-Coding-Guide-for-Python/CWE-691/CWE-783/compliant01.py):_
```python
"""Compliant Code Example"""
def label(number: int) -> list[str]:
labels = []
if number < 0:
labels.append("neg")
if number % 2 == 0:
labels.append("even")
if number < 5:
labels.append("small")
if number >= 5:
labels.append("big")
return labels
for number in range(-6, 6):
print(f"{number} = {label(number)}")
```
## Automated Detection
Tool |
Version |
Checker |
Description |
</hr>
| Bandit |
1.7.4 on Python 3.10.4 |
Not Available |
|
## Related Guidelines
## Bibliography