1090
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Check that critical variables are initialized.
Phase: Testing
Use a static analysis tool to spot non-initialized variables.
Demonstrative Examples
Example 1:
This function attempts to extract a pair of numbers from a user-supplied string.
Example Language: C (Bad)
void parse_data(char *untrusted_input){
int m, n, error;
error = sscanf(untrusted_input, "%d:%d", &m, &n);
if ( EOF == error ){
die("Did not specify integer value. Die evil hacker!\n");
}
/* proceed assuming n and m are initialized correctly */
}
This code attempts to extract two integer values out of a formatted, user-supplied input. However, if
an attacker were to provide an input of the form:
Example Language: (Attack)
123:
then only the m variable will be initialized. Subsequent use of n may result in the use of an
uninitialized variable (CWE-457).
Example 2:
Here, an uninitialized field in a Java class is used in a seldom-called method, which would cause a
NullPointerException to be thrown.
Example Language: Java (Bad)
private User user;
public void someMethod() {
// Do something interesting.
...
// Throws NPE if user hasn't been properly initialized.
String username = user.getName();
}
Example 3:
This code first authenticates a user, then allows a delete command if the user is an administrator.
CWE Version 4.14
CWE-456: Missing Initialization of a Variable
CWE-456: Missing Initialization of a Variable