Irrelevant Code

Opis

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Irrelevant code could include dead code, initialization that is not used, empty blocks, code that could be entirely removed due to optimization, etc.

Skutki

• Other

  Reduce Reliability

• Other

  Reduce Performance

Przykłady podatności

• CVE-2014-1266 Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Słabość nadrzędna

• CWE-710 Improper Adherence to Coding Standards

Słabości podrzędne

• CWE-107 Struts: Unused Validation Form
• CWE-110 Struts: Validator Without Form Field
• CWE-561 Dead Code
• CWE-563 Assignment to Variable without Use
• CWE-1071 Empty Code Block

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific