CWE-628 使用不正确指定参数的函数调用

Function Call with Incorrectly Specified Arguments

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

扩展描述

There are multiple ways in which this weakness can be introduced, including:

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
['Other', 'Access Control'] ['Quality Degradation', 'Gain Privileges or Assume Identity'] This weakness can cause unintended behavior and can lead to additional weaknesses such as allowing an attacker to gain unintended access to system resources.

检测方法

Other

Since these bugs typically introduce obviously incorrect behavior, they are found quickly, unless they occur in rarely-tested code paths. Managing the correct number of arguments can be made more difficult in cases where format strings are used, or when variable numbers of arguments are supported.

可能的缓解方案

Build and Compilation

策略:

Once found, these issues are easy to fix. Use code inspection tools and relevant compiler features to identify potential violations. Pay special attention to code that is not likely to be exercised heavily during QA.

Architecture and Design

策略:

Make sure your API's are stable before you use them in production code.

示例代码

例

The following PHP method authenticates a user given a username/password combination but is called with the parameters in reverse order.

bad PHP

function authenticate($username, $password) {

// authenticate user
...
}

authenticate($_POST['password'], $_POST['username']);

例

This Perl code intends to record whether a user authenticated successfully or not, and to exit if the user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0 instead of 1, so it does not exit.

bad Perl

sub ReportAuth {
my ($username, $result, $fatal) = @_;
PrintLog("auth: username=%s, result=%d", $username, $result);
if (($result ne "success") && $fatal) {
die "Failed!\n";
}
}

sub PrivilegedFunc
{
my $result = CheckAuth($username);
ReportAuth($username, $result, 0);
DoReallyImportantStuff();
}

例

In the following Java snippet, the accessGranted() method is accidentally called with the static ADMIN_ROLES array rather than the user roles.

bad Java

private static final String[] ADMIN_ROLES = ...;
public boolean void accessGranted(String resource, String user) {
String[] userRoles = getUserRoles(user);
return accessGranted(resource, ADMIN_ROLES);
}

private boolean void accessGranted(String resource, String[] userRoles) {

// grant or deny access based on user roles
...
}

分析过的案例

标识 说明 链接

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
CERT C Secure Coding DCL10-C Maintain the contract between the writer and caller of variadic functions
CERT C Secure Coding EXP37-C CWE More Abstract Call functions with the correct number and type of arguments
SEI CERT Perl Coding Standard DCL00-PL CWE More Abstract Do not use subroutine prototypes
SEI CERT Perl Coding Standard EXP33-PL Imprecise Do not invoke a function in a context for which it is not defined