1634 items found
Weaknesses
Abstract
The method throws a generic exception making it harder for callers to do a good job of error handling and recovery.
Explanation
Declaring a method to throw Exception or Throwable makes it difficult for callers to do good error handling and error recovery. Java's exception mechanism is set up to make it easy for callers to anticipate what can go wrong and write code to handle each specific exceptional circumstance. Declaring that a method throws a generic form of exception defeats this system.

Example 1: The following method throws three types of exceptions.


public void doExchange()
throws IOException, InvocationTargetException,
SQLException {
...
}



While it might seem tidier to write


public void doExchange()
throws Exception {
...
}


doing so hampers the caller's ability to understand and handle the exceptions that occur. Further, if a later revision of doExchange() introduces a new type of exception that should be treated differently than previous exceptions, there is no easy way to enforce this requirement.
References
[1] ERR07-J. Do not throw RuntimeException, Exception, or Throwable CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 397
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[4] Standards Mapping - FIPS200 AU
[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[7] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[8] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[21] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.java.poor_error_handling_overly_broad_throws
Abstract
It is generally a bad practice to catch NullPointerException.
Explanation
Programmers typically catch NullPointerException under three circumstances:

1. The program contains a null-pointer dereference. Catching the resulting exception was easier than fixing the underlying problem.

2. The program explicitly throws a NullPointerException to signal an error condition.

3. The code is part of a test harness that supplies unexpected input to the classes under test.

Of these three circumstances, only the last is acceptable.

Example 1: The following code mistakenly catches a NullPointerException.


try {
mysteryMethod();
}
catch (NullPointerException npe) {
}
References
[1] ERR08-J. Do not catch NullPointerException or any of its ancestors CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 395
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[4] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[7] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[8] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[21] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.java.poor_error_handling_program_catches_nullpointerexception
Abstract
It is generally a bad practice to catch NullReferenceException.
Explanation
Programmers typically catch NullReferenceException under three circumstances:

1. The program contains a null-pointer dereference. Catching the resulting exception was easier than fixing the underlying problem.

2. The program explicitly throws a NullReferenceException to signal an error condition.

3. The code is part of a test harness that supplies unexpected input to the classes under test.

Of these three circumstances, only the last is acceptable.

Example 1: The following code mistakenly catches a NullReferenceException.

try {
MysteryMethod();
}
catch (NullReferenceException npe) {
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 395
[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[3] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[6] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[7] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[20] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.dotnet.poor_error_handling_program_catches_nullreferenceexception
Abstract
Returning from inside a finally block will cause exceptions to be lost.
Explanation
A return statement inside a finally block will cause any exception that might be thrown in the try block to be discarded.

Example 1: In the following code excerpt, the MagicException thrown by the second call to doMagic with true passed to it will never be delivered to the caller. The return statement inside the finally block will cause the exception to be discarded.


public class MagicTrick {

public static class MagicException extends Exception { }

public static void main(String[] args) {

System.out.println("Watch as this magical code makes an " +
"exception disappear before your very eyes!");

System.out.println("First, the kind of exception handling " +
"you're used to:");
try {
doMagic(false);
} catch (MagicException e) {
// An exception will be caught here
e.printStackTrace();
}

System.out.println("Now, the magic:");
try {
doMagic(true);
} catch (MagicException e) {
// No exception caught here, the finally block ate it
e.printStackTrace();
}
System.out.println("tada!");
}

public static void doMagic(boolean returnFromFinally)
throws MagicException {

try {
throw new MagicException();
}
finally {
if (returnFromFinally) {
return;
}
}
}

}
References
[1] ERR04-J. Do not complete abruptly from a finally block CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 584
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[4] Standards Mapping - FIPS200 AU
[5] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[8] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[9] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[19] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[21] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[22] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.java.poor_error_handling_return_inside_finally
Abstract
Returning from inside a finally block will cause exceptions to be lost.
Explanation
A return statement inside a finally block will cause any exception that might be thrown in the try block to be discarded.

Example 1: In the following code excerpt, the exception thrown by the second call to doMagic with True passed to it will never be delivered to the caller. The return statement inside the finally block will cause the exception to be discarded.

        "disappear before your very eyes!" . PHP_EOL;

echo "First, the kind of exception handling " .
"you're used to:" . PHP_EOL;

try {
doMagic(False);
} catch (exception $e) {
// An exception will be caught here
echo $e->getMessage();
}

echo "Now, the magic:" . PHP_EOL;

try {
doMagic(True);
} catch (exception $e) {
// No exception caught here, the finally block ate it
echo $e->getMessage();
}

echo "Tada!" . PHP_EOL;

function doMagic($returnFromFinally) {
try {
throw new Exception("Magic Exception" . PHP_EOL);
}
finally {
if ($returnFromFinally) {
return;
}
}
}
?>
References
[1] ERR04-J. Do not complete abruptly from a finally block CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 584
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[4] Standards Mapping - FIPS200 AU
[5] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[8] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[9] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[19] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[21] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[22] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.php.poor_error_handling_return_inside_finally
Abstract
If a ThreadDeath error is not re-thrown, the thread in question might not actually die.
Explanation
ThreadDeath errors should only be caught if an applications needs to clean up after being terminated asynchronously. If a ThreadDeath error is caught, it is important that it be re-thrown so that the thread actually dies. The purpose of throwing ThreadDeath is to stop a thread. If ThreadDeath is swallowed, it can prevent a thread from stopping and result in unexpected behavior since whoever originally threw ThreadDeath expects the thread to stop.

Example 1: The following code catches ThreadDeath but does not re-throw it.

try
{
//some code
}
catch(ThreadDeath td)
{
//clean up code
}
References
[1] Oracle Class ThreadDeath
[2] Scott Oaks, Henry Wong Java Threads O'Reilly
[3] Standards Mapping - Common Weakness Enumeration CWE ID 705
[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[5] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[8] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.java.poor_error_handling_swallowed_threaddeath
Abstract
Using a throw statement inside a finally block breaks the logical progression through the try-catch-finally.
Explanation
In Java, finally blocks are always executed after their corresponding try-catch blocks and are often used to free allocated resources, such as file handles or database cursors. Throwing an exception in a finally block can bypass critical cleanup code since normal program execution will be disrupted.

Example 1: In the following code, the call to stmt.close() is bypassed when the FileNotFoundException is thrown.

public void processTransaction(Connection conn) throws FileNotFoundException
{
FileInputStream fis = null;
Statement stmt = null;
try
{
stmt = conn.createStatement();
fis = new FileInputStream("badFile.txt");
...
}
catch (FileNotFoundException fe)
{
log("File not found.");
}
catch (SQLException se)
{
//handle error
}
finally
{
if (fis == null)
{
throw new FileNotFoundException();
}

if (stmt != null)
{
try
{
stmt.close();
}
catch (SQLException e)
{
log(e);
}
}
}
}
References
[1] Sun Microsystems, Inc. Java Sun Tutorial
[2] ERR05-J. Do not let checked exceptions escape from a finally block CERT
[3] Standards Mapping - Common Weakness Enumeration CWE ID 684
[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[5] Standards Mapping - FIPS200 AU
[6] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[9] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[10] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[21] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[22] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[23] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[45] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
desc.structural.java.poor_error_handling_throw_inside_finally
Abstract
Failing to properly handle an exception can cause the application to overlook unexpected states and conditions.
Explanation
Unhandled exception vulnerabilities occur when:

1. An exception is thrown

2. The exception is not properly handled before it escapes the current page.

Just about every serious attack on a software system begins with the violation of a programmer's assumptions. After the attack, the programmer's assumptions seem flimsy and poorly founded, but before an attack many programmers would defend their assumptions well past the end of their lunch break.

Two dubious assumptions that are easy to spot in code are "this operation can never fail" and "it doesn't matter if this operation fails". When a programmer fails to catch an exception that an operation may throw, they implicitly state that they are operating under one of these assumptions.
References
[1] Adobe Exceptions in ColdFusion 5
[2] Standards Mapping - Common Weakness Enumeration CWE ID 248
[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[4] Standards Mapping - FIPS200 AU
[5] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)
[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling
[8] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.4.2 Error Handling (L2 L3)
[9] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[10] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[21] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[22] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[23] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[45] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[46] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)
[47] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage
desc.dataflow.cfml.unhandled_exception
Abstract
Failing to explicitly handle SSL exceptions can cause the application to overlook unexpected states and conditions.
Explanation
Unhandled SSL exception vulnerabilities occur when:

1. An SSL-specific exception is thrown.

2. The exception is not explicitly handled.

The SSL-specific exceptions javax.net.ssl.SSLHandshakeException, javax.net.ssl.SSLKeyException, and javax.net.ssl.SSLPeerUnverifiedException all convey important errors related to an SSL connection. If these errors are not explicitly handled, the connection can be left in an unexpected and potential insecure state.

Just about every serious attack on a software system begins with the violation of a programmer's assumptions. After the attack, the programmer's assumptions seem flimsy and poorly founded, but before an attack many programmers would defend their assumptions well past the end of their lunch break.

Two dubious assumptions that are easy to spot in code are "this operation can never fail" and "it doesn't matter if this operation fails". When a programmer fails to catch an exception that an operation may throw, they implicitly state that they are operating under one of these assumptions.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 248
[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272
[3] Standards Mapping - FIPS200 AU
[4] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SC-24 Fail in Known State (P1), SI-11 Error Handling (P2)
[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SC-24 Fail in Known State, SI-11 Error Handling
[7] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.4.2 Error Handling (L2 L3)
[8] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-NETWORK-1
[9] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[10] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[21] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[22] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation
[23] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II
[26] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002310 CAT I, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002310 CAT I, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[45] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002310 CAT I, APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II
[46] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)
[47] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage
desc.structural.java.poor_error_handling_unhandled_ssl_exception
Abstract
Declare loggers to be static and final.
Explanation
It is good programming practice to share a single logger object between all of the instances of a particular class and to use the same logger for the duration of the program.

Example 1: The following statement errantly declares a non-static logger.


private final Logger logger =
Logger.getLogger(MyClass.class);
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
desc.structural.java.poor_logging_practice_logger_is_not_declared_static_final
Abstract
Use logging levels rather than multiple loggers in a single class.
Explanation
Good logging practice dictates the use of a single logger for each class.

Example 1: The following code errantly declares multiple loggers.


public class MyClass {
private final static Logger good =
Logger.getLogger(MyClass.class);
private final static Logger bad =
Logger.getLogger(MyClass.class);
private final static Logger ugly =
Logger.getLogger(MyClass.class);
...
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000154
[3] Standards Mapping - FIPS200 AU
[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-6 Audit Review and Analysis and Reporting (P1)
[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-6 Audit Record Review and Analysis and Reporting
[6] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001130 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001130 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-001130 CAT II
desc.structural.java.poor_logging_practice_multiple_loggers
Abstract
Using Console.Out or Console.Error rather than a dedicated logging facility makes it difficult to monitor the program behavior.
Explanation
Example 1: The first .NET program that a developer learns to write is the following:


public class MyClass {
...
Console.WriteLine("hello world");
...
}


While most programmers go on to learn many nuances and subtleties about .NET, a surprising number hang on to this first lesson and never give up on writing messages to standard output using Console.WriteLine().

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of Console.WriteLine may indicate an oversight in the move to a structured logging system.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.structural.dotnet.poor_logging_practice_use_of_a_system_output_stream
Abstract
Using os.Stdout or os.Stderr rather than a dedicated logging facility makes it difficult to monitor the program behavior.
Explanation
Example 1: Typically, the first Go program that a developer learns to write is the following:


...

func foo(){
fmt.Println("Hello World")
}


While most developers go on to learn many nuances and subtleties about Go, some never give up on writing messages to standard output using fmt.Println().

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features such as logging levels, uniform formatting, a logger identifier, timestamps, and the ability to direct log messages to a proper location. When the use of system output streams is jumbled together with code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Structured logging is widely accepted but many developers continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, logging to os.Stdout or os.Stderr might indicate an oversight in the move to a structured logging system.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.semantic.golang.poor_logging_practice_use_of_a_system_output_stream
Abstract
Using System.out or System.err rather than a dedicated logging facility makes it difficult to monitor the program behavior.
Explanation
Example 1: The first Java program that a developer learns to write is the following:


public class MyClass
...
System.out.println("hello world");
...
}


While most programmers go on to learn many nuances and subtleties about Java, a surprising number hang on to this first lesson and never give up on writing messages to standard output using System.out.println().

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of System.out or System.err may indicate an oversight in the move to a structured logging system.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.structural.java.poor_logging_practice_use_of_a_system_output_stream
Abstract
Using process.stdout or process.stderr rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.
Explanation
Example 1: A simple program an early Node.js developer may write to read from stdin and write it back to stdout again may look like the following:


process.stdin.on('readable', function(){
var s = process.stdin.read();
if (s != null){
process.stdout.write(s);
}
});


While most programmers go on to learn many nuances and subtleties about JavaScript and Node.js in particular, many will hang on to this first lesson and never give up on writing messages to standard output using process.stdout.write().

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of process.stdout or process.stderr may indicate an oversight in the move to a structured logging system.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.structural.javascript.poor_logging_practice_use_of_a_system_output_stream
Abstract
Using print or println rather than a dedicated logging facility makes it difficult to monitor the program behavior.
Explanation
Example 1: The first Kotlin program that a developer learns to write is the following:


class MyClass {
...
println("hello world")
...
}
}


While most programmers go on to learn many nuances and subtleties about Kotlin, a surprising number hang on to this first lesson and never give up on writing messages to standard output using print or println.

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of the standard ouput or error stream may indicate an oversight in the move to a structured logging system.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.structural.kotlin.poor_logging_practice_use_of_a_system_output_stream
Abstract
Using standard output or standard error rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.
Explanation
Example 1: The first Python program that a developer learns to write usually looks like this:


sys.stdout.write("hello world")


While most programmers go on to learn many nuances and subtleties about Python, a surprising number hang on to this first lesson and never give up on writing messages to standard output.

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of sys.stdout or sys.stderr may indicate an oversight in the move to a structured logging system.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.structural.python.poor_logging_practice_use_of_a_system_output_stream
Abstract
Using Kernel.puts,Kernel.warn or Kernel.printf rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.
Explanation
Example 1: The first Ruby program that a developer learns to write often will include functionality such as:


...
puts "hello world"
...


While most programmers go on to learn many nuances and subtleties about Ruby, a surprising number hang on to this first lesson and never give up on writing messages to standard output using Kernel.puts.

The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.

Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of Kernel.puts,Kernel.warn or Kernel.printf may indicate an oversight in the move to a structured logging system.
If there is a company policy not to use these APIs, this could still be worked around via the use of a logging system to then print the information to a system output stream.

Example 2: The following code uses the Logger class, but logs information to a system output stream:


require 'logger'
...
logger = Logger.new($stdout)
logger.info("hello world")
...
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 778
[2] Standards Mapping - FIPS200 AU
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-11 Error Handling (P2)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-11 Error Handling
[5] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling
[6] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 10.3.1
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 10.3.1
[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention
[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention
[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention
[19] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3620 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3620 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3620 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3620 CAT II
[23] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3620 CAT II
[24] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3620 CAT II
[25] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3620 CAT II
desc.structural.ruby.poor_logging_practice_use_of_a_system_output_stream
Abstract
The class contains a field and a method with the same name.
Explanation
It is confusing to have a member field and a method with the same name. It makes it easy for a programmer to accidentally call the method when attempting to access the field or vice versa.

Example 1:

public class Totaller {
private int total;
public int total() {
...
}
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 710
[2] Standards Mapping - Smart Contract Weakness Classification SWC-119
desc.structural.java.poor_style_confusing_naming.member_and_method
Abstract
The contract uses a shadowed variable which is ambiguous and prone to misuse.
Explanation
Solidity allows developers to ambiguously declare state variables. This means that even though two different variables in two different contexts can be declared with the same name, using them can lead to confusion and misuse.

This can happen both at the function level and at the inheritance level. For example, if Contract1 declares var1 and inherits from Contract2, which also declares a variable named var1, then the variable is ambiguous and can easily be confused with each other later in the smart contract execution.

Example 1: The following code uses inheritance and declares a state variable with the same name in both smart contracts. It can be hard to determine which is the actual hardcap of the token sale.


contract Tokensale {
uint hardcap = 10000 ether;

function Tokensale() { }

function fetchCap() public constant returns(uint) {
return hardcap;
}
}

contract Presale is Tokensale {
uint hardcap = 1000 ether;

function Presale() Tokensale() { }
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 710
[2] Standards Mapping - Smart Contract Weakness Classification SWC-119
desc.structural.solidity.swc119
Abstract
This synchronized block contains no statements; it is unlikely the synchronization achieves the intended effect.
Explanation
Synchronization in Java can be tricky. An empty synchronized block is often a sign that a programmer is wrestling with synchronization but has not yet achieved the result they intend.

Example 1:

synchronized(this) { }
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 585
desc.structural.java.poor_style_empty_synchronized_block
Abstract
The finalize() method should only be called by the JVM after the object has been garbage collected.
Explanation
While the Java Language Specification allows an object's finalize() method to be called from outside the finalizer, doing so is usually a bad idea. For example, calling finalize() explicitly means that finalize() will be called more than once: the first time will be the explicit call and the last time will be the call that is made after the object is garbage collected.

Example 1: The following code fragment calls finalize() explicitly:


// time to clean up
widget.finalize();
References
[1] MET12-J. Do not use finalizers CERT
[2] Standards Mapping - Common Weakness Enumeration CWE ID 586
desc.structural.java.poor_style_explicit_call_to_finalize
Abstract
Using a dollar sign ($) as part of an identifier is not recommended.
Explanation
Section 3.8 of the Java Language Specification reserves the dollar sign ($) for identifiers that are used only in mechanically generated source code.

Example 1:

int un$afe;
References
[1] J. Gosling, B. Joy, G. Steele, G. Bracha The Java Language Specification, Second Edition Addison-Wesley
[2] Standards Mapping - Common Weakness Enumeration CWE ID 684
desc.structural.java.poor_style_identifier_contains_dollar_symbol
Abstract
Non-final public static fields can be changed by external classes.
Explanation
Typically, you do not want to provide external classes direct access to your object's member fields since a public field can be changed by any external class. Good object oriented designed uses encapsulation to prevent implementation details, such as member fields, from being exposed to other classes. Further, if the system assumes that this field cannot be changed, then malicious code might be able to adversely change the behavior of the system.

Example 1: In the following code, the field ERROR_CODE is declared as public and static, but not final:


public class MyClass
{
public static int ERROR_CODE = 100;
//...
}


In this case, malicious code might be able to change this error code and cause the program to behave in an unexpected manner.
References
[1] Sun Microsystems, Inc. Secure Coding Guidelines for the Java Programming Language, version 2.0
[2] OBJ10-J. Do not use public static nonfinal fields CERT
[3] MUTABLE-9: Make public static fields final Oracle
[4] Standards Mapping - Common Weakness Enumeration CWE ID 493
desc.structural.java.poor_style_non-final_public_static_field
Abstract
The variable's value is assigned but never used, making it a dead store.
Explanation
This variable's initial value is not used. After initialization, the variable is either assigned another value or goes out of scope.

Example 1: The following code excerpt assigns to the variable r and then overwrites the value without using it.


int r = getNum();
r = getNewNum(buf);
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 563
[2] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3050 CAT II
[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3050 CAT II
[4] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3050 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3050 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3050 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3050 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3050 CAT II
desc.structural.cpp.poor_style_redundant_initialization
Abstract
The variable's value is assigned but never used, making it a dead store.
Explanation
This variable's initial value is not used. After initialization, the variable is either assigned another value or goes out of scope.

Example 1: The following code excerpt assigns to the variable r and then overwrites the value without using it.


int r = getNum();
r = getNewNum(buf);
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 563
[2] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3050 CAT II
[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3050 CAT II
[4] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3050 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3050 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3050 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3050 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3050 CAT II
desc.structural.java.poor_style_redundant_initialization
Abstract
The variable's value is assigned but never used, making it a dead store.
Explanation
This variable's value is not used. After the assignment, the variable is either assigned another value or goes out of scope.

Example 1: The following code excerpt assigns to the variable r and then overwrites the value without using it.


r = getName();
r = getNewBuffer(buf);
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 563
[2] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3050 CAT II
[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3050 CAT II
[4] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3050 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3050 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3050 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3050 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3050 CAT II
desc.structural.cpp.poor_style_value_never_read
Abstract
The variable's value is assigned but never used, making it a dead store.
Explanation
This variable's value is not used. After the assignment, the variable is either assigned another value or goes out of scope.

Example 1: The following code excerpt assigns to the variable r and then overwrites the value without using it.


r = getName();
r = getNewBuffer(buf);
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 563
[2] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3050 CAT II
[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3050 CAT II
[4] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3050 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3050 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3050 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3050 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3050 CAT II
desc.structural.java.poor_style_value_never_read
Abstract
This variable is never used.
Explanation
This variable is never used. It is likely that the variable is simply vestigial, but it is also possible that the unused variable points out a bug.

Example 1: In the following code, a copy-and-paste error has led to the same loop iterator (i) being used twice. The variable j is never used.


int i,j;

for (i=0; i < outer; i++) {
for (i=0; i < inner; i++) {
...
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 563
[2] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C Guidelines 2023 Rule 2.8
[3] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C++ Guidelines 2008 Rule 0-1-3
[4] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C++ Guidelines 2023 Rule 0.1.2, Rule 0.2.1, Rule 0.2.2, Rule 0.2.3, Rule 0.2.4
[5] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3050 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3050 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3050 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3050 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3050 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3050 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3050 CAT II
[12] Standards Mapping - Smart Contract Weakness Classification SWC-131
desc.structural.cpp.poor_style_variable_never_used
Abstract
The contract defines a variable but never uses it.
Explanation
Solidity permits variables to be declared and never used and although most of the time this does not directly point to a security vulnerability, it is a bad practice. It can cause noise and unnecessary gas consumption due to the required increased computation cycles.

Example 1: The following code declares the variable var1 of type A but never uses it.


contract Base {
struct A { uint a; }
}

contract DerivedA is Base {
A var1 = A(1);
int internal j = 500;

function call(int a) public {
assign1(a);
}

function assign3(A memory x) public returns (uint) {
return g[1] + x.a + uint(j);
}
}
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 563
[2] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C Guidelines 2023 Rule 2.8
[3] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C++ Guidelines 2008 Rule 0-1-3
[4] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C++ Guidelines 2023 Rule 0.1.2, Rule 0.2.1, Rule 0.2.2, Rule 0.2.3, Rule 0.2.4
[5] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3050 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3050 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3050 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3050 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3050 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3050 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3050 CAT II
[12] Standards Mapping - Smart Contract Weakness Classification SWC-131
desc.structural.solidity.swc131
Abstract
Functions with inconsistent implementations across operating systems and operating system versions cause portability problems.
Explanation
The behavior of functions in this category varies by operating system, and at times, even by operating system version. Implementation differences can include:

- Slight differences in the way parameters are interpreted leading to inconsistent results.

- Some implementations of the function carry significant security risks.

- The function might not be defined on all platforms.
References
[1] Standards Mapping - Common Weakness Enumeration CWE ID 474
[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001310
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation
[5] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002520 CAT II
[6] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002520 CAT II
[7] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002520 CAT II
[8] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002520 CAT II
[9] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002520 CAT II
[10] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002520 CAT II
[11] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002520 CAT II
[12] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002520 CAT II
[13] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002520 CAT II
[14] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002520 CAT II
[15] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002520 CAT II
[16] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002520 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002520 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002520 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002520 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002520 CAT II
desc.semantic.cpp.portability_flaw