CWE-670: Always-Incorrect Control Flow Implementation

This code queries a server and displays its status when a request comes from an authorized IP address.

This code redirects unauthorized users, but continues to execute code after calling http_redirect(). This means even unauthorized users may be able to access the contents of the page or perform a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address spoofing attack (CWE-212).

$requestingIP = $_SERVER['REMOTE_ADDR'];if(!in_array($requestingIP,$ipAllowList)){echo "You are not authorized to view this page";http_redirect($errorPageURL);}$status = getServerStatus();echo $status;                ...

In this example, the programmer has indented the statements to call Do_X() and Do_Y(), as if the intention is that these functions are only called when the condition is true. However, because there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.

This might not be what the programmer intended. When the condition is critical for security, such as in making a security decision or detecting a critical error, this may produce a vulnerability.

if (condition==true)Do_X();Do_Y();

In both of these examples, a message is printed based on the month passed into the function:

Both examples do not use a break statement after each case, which leads to unintended fall-through behavior. For example, calling "printMessage(10)" will result in the text "OctoberNovemberDecember is a great month" being printed.

public void printMessage(int month){                switch (month) {                                case 1: print("January");case 2: print("February");case 3: print("March");case 4: print("April");case 5: print("May");case 6: print("June");case 7: print("July");case 8: print("August");case 9: print("September");case 10: print("October");case 11: print("November");case 12: print("December");                }println(" is a great month");                }

In both of these examples, a message is printed based on the month passed into the function:

Both examples do not use a break statement after each case, which leads to unintended fall-through behavior. For example, calling "printMessage(10)" will result in the text "OctoberNovemberDecember is a great month" being printed.

void printMessage(int month){                switch (month) {                                case 1: printf("January");case 2: printf("February");case 3: printf("March");case 4: printf("April");case 5: printff("May");case 6: printf("June");case 7: printf("July");case 8: printf("August");case 9: printf("September");case 10: printf("October");case 11: printf("November");case 12: printf("December");                }printf(" is a great month");                }

In the excerpt below, an AssertionError (an unchecked exception) is thrown if the user hasn't entered an email address in an HTML form.

String email = request.getParameter("email_address");assert email != null;