CWE-395 使用NullPointerException捕捉来检测空指针解引用
Use of NullPointerException Catch to Detect NULL Pointer Dereference
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
扩展描述
Programmers typically catch NullPointerException under three circumstances:
Of these three circumstances, only the last is acceptable.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 705 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 755 cwe_View_ID: 1000
适用平台
Language: {'cwe_Name': 'Java', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Availability | DoS: Resource Consumption (CPU) |
检测方法
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful:
- Bytecode Weakness Analysis - including disassembler + source code weakness analysis
- Binary Weakness Analysis - including disassembler + source code weakness analysis
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Framework-based Fuzzer
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Manual Source Code Review (not inspections)
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Source code Weakness Analyzer
- Context-configured Source Code Weakness Analyzer
Architecture or Design Review
According to SOAR, the following detection techniques may be useful:
- Formal Methods / Correct-By-Construction
- Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
可能的缓解方案
['Architecture and Design', 'Implementation']
策略:
Do not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.
示例代码
例
The following code mistakenly catches a NullPointerException.
bad Java
} catch (NullPointerException npe) {
}
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| 7 Pernicious Kingdoms | Catching NullPointerException | ||
| The CERT Oracle Secure Coding Standard for Java (2011) | ERR08-J | Do not catch NullPointerException or any of its ancestors |
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论