1163
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Other Alter Execution Logic
This weakness can cause unintended logic to be executed
and other unexpected application behavior.
Detection Methods
White Box
Omission of a break statement might be intentional, in order to support fallthrough. Automated
detection methods might therefore be erroneous. Semantic understanding of expected product
behavior is required to interpret whether the code is correct.
Black Box
Since this weakness is associated with a code construct, it would be indistinguishable from other
errors that produce the same behavior.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Omitting a break statement so that one may fall through is often indistinguishable from an error,
and therefore should be avoided. If you need to use fall-through capabilities, make sure that you
have clearly documented this within the switch statement, and ensure that you have examined all
the logical possibilities.
Phase: Implementation
The functionality of omitting a break statement could be clarified with an if statement. This
method is much safer.
Demonstrative Examples
Example 1:
In both of these examples, a message is printed based on the month passed into the function:
Example Language: Java (Bad)
public void printMessage(int month){
switch (month) {
case 1: print("January");
case 2: print("February");
case 3: print("March");
case 4: print("April");
case 5: print("May");
case 6: print("June");
case 7: print("July");
case 8: print("August");
case 9: print("September");
case 10: print("October");
CWE Version 4.14
CWE-486: Comparison of Classes by Name
CWE-486: Comparison of Classes by Name