Suspicious =+ / =- Assignment

ID

javascript.suspicious_plus_assignment

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

JavaScript

Tags

reliability, typo

Description

Reports the textual pattern a =+ b (no whitespace between = and +, or between = and -). The parser reads this as a regular assignment of a unary expression — a = +b — which is identical to a deliberate numeric coercion. The hazard is the nearly identical compound-assignment form a += b that the developer almost always meant to write:

total =+ delta;     // FLAW — looks like total += delta but parses as total = +delta
count =- step;      // FLAW — looks like count -= step but parses as count = -step

Rationale

A single missed Shift key turns a += b into a =+ b. The two forms are visually almost indistinguishable, but their semantics differ completely:

  • a += b increments a by b.

  • a = +b discards a’s previous value and stores the unary-plus coercion of `b.

Test suites built on the increment behaviour silently pass garbage state, and the bug usually only surfaces when the running totals start drifting.

Remediation

Insert a space — a = +b — when the unary plus is intentional, or fix the compound assignment:

total += delta;     // increment
total = +delta;     // explicit assignment of the coerced value (with a space)

Notes

The rule fires only when the assignment is a plain = (not +=, -=, …​) AND the right-hand side starts with a unary + or - AND the underlying tokens are adjacent in the source — the = token’s end offset equals the unary operator’s begin offset. With even a single space, the offsets diverge and the rule stays silent — that is, deliberate a = +b and a = -b are accepted.

References