CWE-233 参数问题

Improper Handling of Parameters

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 228 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 228 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
Integrity Unexpected State

示例代码

例

This application has registered to handle a URL when sent an intent:

bad Java


...
IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
...

public class UrlHandlerReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
if("com.example.URLHandler.openURL".equals(intent.getAction())) {
String URL = intent.getStringExtra("URLToOpen");
int length = URL.length();

...
}
}
}

The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Parameter Problems

相关攻击模式

  • CAPEC-39