CWE-544 标准化错误处理机制缺失

Missing Standardized Error Handling Mechanism

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

扩展描述

If the application handles error messages individually, on a one-by-one basis, this is likely to result in inconsistent error handling. The causes of errors may be lost. Also, detailed information about the causes of an error may be unintentionally returned to the user.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 755 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

范围	影响	注释
['Integrity', 'Other']	['Quality Degradation', 'Unexpected State', 'Varies by Context']

可能的缓解方案

Architecture and Design

策略:

define a strategy for handling errors of different severities, such as fatal errors versus basic log events. Use or create built-in language features, or an external package, that provides an easy-to-use API and define coding standards for the detection and handling of errors.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
CERT C Secure Coding	ERR00-C		Adopt and implement a consistent and comprehensive error-handling policy

文章来源于互联网:scap中文网