Dead Code

Opis

The product contains dead code, which can never be executed.

Dead code is code that can never be executed in a running program. The surrounding code makes it impossible for a section of code to ever be executed.

Skutki

• Other

  Quality Degradation

  Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.

• Other

  Reduce Maintainability

Zapobieganie

• Implementation

  Remove dead code before deploying the application.

Przykłady podatności

• CVE-2014-1266 Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Słabość nadrzędna

• CWE-1164 Irrelevant Code

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Źródła

1. Automated Source Code Maintainability Measure (ASCMM) — Object Management Group (OMG), ASCMM-MNT-20, 2016
2. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014