1141
In the following code, the programmer assumes that the system always has a property named
"cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined,
the program throws a null pointer exception when it attempts to call the "Trim()" method.
Example Language: Java (Bad)
String cmd = null;
...
cmd = Environment.GetEnvironmentVariable("cmd");
cmd = cmd.Trim();
Example 3:
The following code constructs a string object from an array of bytes and a value that specifies the
top 8 bits of each 16-bit Unicode character.
Example Language: Java (Bad)
...
String name = new String(nameBytes, highByte);
...
In this example, the constructor may not correctly convert bytes to characters depending upon
which charset is used to encode the string represented by nameBytes. Due to the evolution of the
charsets used to encode strings, this constructor was deprecated and replaced by a constructor
that accepts as one of its parameters the name of the charset used to encode the bytes for
conversion.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 398 7PK - Code Quality 700 2323
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1180 SEI CERT Perl Coding Standard - Guidelines 02.
Declarations and Initialization (DCL)
1178 2465
MemberOf 1181 SEI CERT Perl Coding Standard - Guidelines 03.
Expressions (EXP)
1178 2466
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Obsolete
Software Fault Patterns SFP3 Use of an improper API
SEI CERT Perl Coding
Standard
DCL30-
PL
CWE More Specific Do not import deprecated modules
SEI CERT Perl Coding
Standard
EXP30-
PL
CWE More Specific Do not use deprecated or obsolete
functions or modules
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
CWE Version 4.14
CWE-478: Missing Default Case in Multiple Condition Expression
CWE-478: Missing Default Case in Multiple Condition Expression