Missing Handler

Opis

A handler is not available or implemented.

When an exception is thrown and not caught, the process has given up an opportunity to decide if a given failure or event is worth a change in execution.

Skutki

• Other

  Varies by Context

Zapobieganie

• Implementation

  Handle all possible situations (e.g. error condition).

• Implementation

  If an operation can throw an Exception, implement a handler for that specific exception.

Przykłady podatności

• CVE-2022-25302 SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a cast fails, allowing for a crash

Słabość nadrzędna

• CWE-691 Insufficient Control Flow Management

Może prowadzić do

• CWE-433 Unparsed Raw Web Content Delivery

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 3, "File Handlers", Page 74, Addison Wesley, 2006