CWE-395 使用NullPointerException捕捉来检测空指针解引用

Use of NullPointerException Catch to Detect NULL Pointer Dereference

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

扩展描述

Programmers typically catch NullPointerException under three circumstances:

Of these three circumstances, only the last is acceptable.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 705 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 755 cwe_View_ID: 1000

适用平台

Language: {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
Availability	DoS: Resource Consumption (CPU)

检测方法

Automated Static Analysis - Binary or Bytecode

Dynamic Analysis with Manual Results Interpretation

Manual Static Analysis - Source Code

Automated Static Analysis - Source Code

Architecture or Design Review

可能的缓解方案

['Architecture and Design', 'Implementation']

策略:

Do not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.

示例代码

例

The following code mistakenly catches a NullPointerException.

bad Java

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
7 Pernicious Kingdoms			Catching NullPointerException
The CERT Oracle Secure Coding Standard for Java (2011)	ERR08-J		Do not catch NullPointerException or any of its ancestors

文章来源于互联网:scap中文网