571
Weakness ID : 230
Structure : Simple
Abstraction : Variant
Description
The product does not handle or incorrectly handles when a parameter, field, or argument name is
specified, but the associated value is missing, i.e. it is empty, blank, or null.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 229 Improper Handling of Values 570
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Demonstrative Examples
Example 1:
This Android application has registered to handle a URL when sent an intent:
Example Language: Java (Bad)
...
IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
...
public class UrlHandlerReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
if("com.example.URLHandler.openURL".equals(intent.getAction())) {
String URL = intent.getStringExtra("URLToOpen");
int length = URL.length();
...
}
}
}
The application assumes the URL will always be included in the intent. When the URL is not
present, the call to getStringExtra() will return null, thus causing a null pointer exception when
length() is called.
Observed Examples
Reference Description
CVE-2002-0422 Blank Host header triggers resultant infoleak.
https://www.cve.org/CVERecord?id=CVE-2002-0422
CVE-2000-1006 Blank "charset" attribute in MIME header triggers crash.
https://www.cve.org/CVERecord?id=CVE-2000-1006
CVE-2004-1504 Blank parameter causes external error infoleak.
CWE Version 4.14
CWE-231: Improper Handling of Extra Values
CWE-231: Improper Handling of Extra Values