The code does not explicitly delimit a block that is intended
to contain 2 or more statements, creating a logic error.
Extended Description
In some languages, forgetting to explicitly delimit a block can result in
a logic error that can, in turn, have security implications.
Time of Introduction
Implementation
Applicable Platforms
Languages
C: (Sometimes)
C++: (Sometimes)
Common Consequences
Scope
Effect
Confidentiality
Integrity
Availability
This is a general logic error which will often lead to
obviously-incorrect behaviors that are quickly noticed and fixed. In
lightly tested or untested code, this error may be introduced it into a
production environment and provide additional attack vectors by creating
a control flow path leading to an unexpected state in the application.
The consequences will depend on the types of behaviors that are being
incorrectly executed.
Likelihood of Exploit
Low
Demonstrative Examples
Example 1
In this example, when the condition is true, the intention may be
that both x and y run.
(Bad Code)
if (condition==true)
x;
y;
Potential Mitigations
Phase
Description
Implementation
Always use explicit block delimitation and use static-analysis
technologies to enforce this practice.
Other Notes
In many languages, braces are optional for blocks, and -- in a case where
braces are omitted -- it is possible to insert a logic error where a
statement is thought to be in a block but is not. This is a common and well
known reliability error.
Description
