569
Effectiveness = High
Demonstrative Examples
Example 1:
This Android application has registered to handle a URL when sent an intent:
Example Language: Java (Bad)
...
IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
...
public class UrlHandlerReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
if("com.example.URLHandler.openURL".equals(intent.getAction())) {
String URL = intent.getStringExtra("URLToOpen");
int length = URL.length();
...
}
}
}
The application assumes the URL will always be included in the intent. When the URL is not
present, the call to getStringExtra() will return null, thus causing a null pointer exception when
length() is called.
Observed Examples
Reference Description
CVE-2004-0270 Anti-virus product has assert error when line length is non-numeric.
https://www.cve.org/CVERecord?id=CVE-2004-0270
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 728 OWASP Top Ten 2004 Category A7 - Improper Error
Handling
711 2337
MemberOf 884 CWE Cross-section 884 2567
MemberOf 993 SFP Secondary Cluster: Incorrect Input Handling 888 2417
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Maintenance
This entry needs more investigation. Public vulnerability research generally focuses on the
manipulations that generate invalid structure, instead of the weaknesses that are exploited by
those manipulations. For example, a common attack involves making a request that omits a
required field, which can trigger a crash in some cases. The crash could be due to a named
chain such as CWE-690 (Unchecked Return Value to NULL Pointer Dereference), but public
reports rarely cover this aspect of a vulnerability.
Theoretical
The validity of input could be roughly classified along "syntactic", "semantic", and "lexical"
dimensions. If the specification requires that an input value should be delimited with the "[" and
"]" square brackets, then any input that does not follow this specification would be syntactically
CWE Version 4.14
CWE-229: Improper Handling of Values
CWE-229: Improper Handling of Values