CWE-483 Base Rascunho Low likelihood

Incorrect Block Delimitation

This vulnerability occurs when a developer fails to use explicit braces or delimiters to group multiple statements within a block, leading to unexpected program logic.

Definição

What is CWE-483?

This vulnerability occurs when a developer fails to use explicit braces or delimiters to group multiple statements within a block, leading to unexpected program logic.
In programming languages like JavaScript, Python, or Go, braces, indentation, or keywords are sometimes optional for single-statement blocks. However, when you intend for multiple statements to execute together—such as within an `if` condition or a loop—omitting the explicit block delimiter means only the first statement is controlled by that condition. Subsequent statements execute unconditionally, creating a critical logic error. This error often manifests as a subtle bug where security-critical operations, like privilege checks or input validation, are bypassed. For example, an access control check might only guard a logging statement while allowing the actual data transaction to proceed without authorization. Always use explicit delimiters for multi-statement blocks to ensure your code's logic and security controls behave as intended.
Impacto no mundo real

Real-world CVEs caused by CWE-483

  • CVE-2014-1266

    incorrect indentation of "goto" statement makes it more difficult to detect an incorrect goto (Apple's "goto fail")

Como os atacantes a exploram

Trajeto do atacante passo a passo

  1. 1

    In this example, the programmer has indented the statements to call Do_X() and Do_Y(), as if the intention is that these functions are only called when the condition is true. However, because there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.

  2. 2

    This might not be what the programmer intended. When the condition is critical for security, such as in making a security decision or detecting a critical error, this may produce a vulnerability.

  3. 3

    In this example, the programmer has indented the Do_Y() statement as if the intention is that the function should be associated with the preceding conditional and should only be called when the condition is true. However, because Do_X() was called on the same line as the conditional and there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.

  4. 4

    This might not be what the programmer intended. When the condition is critical for security, such as in making a security decision or detecting a critical error, this may produce a vulnerability.

Exemplo de código vulnerável

Vulnerable C

In this example, the programmer has indented the statements to call Do_X() and Do_Y(), as if the intention is that these functions are only called when the condition is true. However, because there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.

Vulnerável C 
if (condition==true)
  	Do_X();
  	Do_Y();
Exemplo de código seguro

Secure pseudo

Seguro pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção

How to prevent CWE-483

  • Implementation Always use explicit block delimitation and use static-analysis technologies to enforce this practice.
Sinais de deteção

How to detect CWE-483

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Correção automática do Plexicus

O Plexicus deteta automaticamente o CWE-483 e abre um PR de correção em menos de 60 segundos.

O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.

Obter uma demonstração Experimente o Plexicus gratuitamente
Perguntas frequentes

Frequently asked questions

O que é o CWE-483?

This vulnerability occurs when a developer fails to use explicit braces or delimiters to group multiple statements within a block, leading to unexpected program logic.

Qual a gravidade do CWE-483?

A MITRE classifica a probabilidade de exploração como Baixa — a exploração é pouco comum, mas a fraqueza deve mesmo assim ser corrigida quando descoberta.

Que linguagens ou plataformas são afetadas pelo CWE-483?

MITRE lists the following affected platforms: C, C++.

Como posso prevenir o CWE-483?

Always use explicit block delimitation and use static-analysis technologies to enforce this practice.

Como é que o Plexicus deteta e corrige o CWE-483?

O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-483 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.

Onde posso saber mais sobre o CWE-483?

A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/483.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.

Fraquezas relacionadas

Weaknesses related to CWE-483

CWE-670 Pai

Always-Incorrect Control Flow Implementation

This weakness occurs when a section of code is structured in a way that always executes incorrectly, regardless of input or conditions.…

CWE-480 Irmão

Use of Incorrect Operator

This vulnerability occurs when a developer mistakenly uses the wrong operator in their code, leading to unintended and potentially…

CWE-484 Irmão

Omitted Break Statement in Switch

This vulnerability occurs when a developer forgets to include a 'break' statement inside a switch-case block. Without it, the code…

CWE-617 Irmão

Reachable Assertion

A reachable assertion occurs when an attacker can trigger an assert() statement or similar debugging check, causing the application to…

CWE-698 Irmão

Execution After Redirect (EAR)

Execution After Redirect (EAR) occurs when a web application sends a redirect response to a user's browser but continues to run…

CWE-783 Irmão

Operator Precedence Logic Error

This vulnerability occurs when a developer writes a conditional expression where the intended logic is broken due to misunderstanding or…

Recursos

Further reading

Pronto quando você estiver

Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.

O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.

Começar grátis Reservar uma demo