1164
case 11: print("November");
case 12: print("December");
}
println(" is a great month");
}
Example Language: C (Bad)
void printMessage(int month){
switch (month) {
case 1: printf("January");
case 2: printf("February");
case 3: printf("March");
case 4: printf("April");
case 5: printff("May");
case 6: printf("June");
case 7: printf("July");
case 8: printf("August");
case 9: printf("September");
case 10: printf("October");
case 11: printf("November");
case 12: printf("December");
}
printf(" is a great month");
}
Both examples do not use a break statement after each case, which leads to unintended
fall-through behavior. For example, calling "printMessage(10)" will result in the text
"OctoberNovemberDecember is a great month" being printed.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 962 SFP Secondary Cluster: Unchecked Status Condition 888 2400
MemberOf 1306 CISQ Quality Measures - Reliability 1305 2483
MemberOf 1307 CISQ Quality Measures - Maintainability 1305 2484
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Omitted break statement
Software Fault Patterns SFP4 Unchecked Status Condition
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-486: Comparison of Classes by Name
Weakness ID : 486
Structure : Simple
Abstraction : Variant
CWE Version 4.14
CWE-486: Comparison of Classes by Name
CWE-486: Comparison of Classes by Name