CWE-230 缺失值处理不恰当
Improper Handling of Missing Values
结构: Simple
Abstraction: Variant
状态: Draft
被利用可能性: unkown
基本描述
The software does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 229 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 229 cwe_View_ID: 699 cwe_Ordinal: Primary
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Integrity | Unexpected State |
示例代码
例
This application has registered to handle a URL when sent an intent:
bad Java
...
IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
...
public class UrlHandlerReceiver extends BroadcastReceiver {
public void onReceive(Context context, Intent intent) {
int length = URL.length();
...
}
}
}
The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2002-0422 | Blank Host header triggers resultant infoleak. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0422 |
| CVE-2000-1006 | Blank "charset" attribute in MIME header triggers crash. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1006 |
| CVE-2004-1504 | Blank parameter causes external error infoleak. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1504 |
| CVE-2005-2053 | Blank parameter causes external error infoleak. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2053 |
Notes
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Missing Value Error | ||
| The CERT Oracle Secure Coding Standard for Java (2011) | ERR08-J | Do not catch NullPointerException or any of its ancestors |
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论